{"id":"CVE-2026-118448","kind":"vulnerability","aliases":["CVE-2026-118448"],"related":[],"title":"pybddisasm: uninitialized output buffer can leak process memory on failure","description":"A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text. If the underlying text conversion fails, including failures caused by invalid parameters, the output buffer may remain uninitialized while still being converted into a Python return value. This may disclose residual process memory or cause the Python process to crash. Exploitation requires an application to invoke nd_to_text in a way that causes conversion to fail and to return or otherwise use the resulting output. The pybddisasm package is no longer maintained.","summary":"The pybddisasm Python bindings return an output buffer from nd_to_text even when text conversion fails, so the buffer may hold uninitialized data. An attacker who can reach an application that passes it failing inputs may read residual process memory or crash the Python process.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["disassembly","package","pybddisasm","python"],"not_affected_if":["no-nd_to_text-calls","trusted-input-only"],"how_to_check":"- `pip show pybddisasm` to see whether the package is installed and which version\n- Search the project for calls to `nd_to_text` whose results are returned or used when conversion fails\n- Confirm whether the application accepts invalid parameters from untrusted input","fix":null,"status":"open","published_at":"2026-11-03T09:17:11+00:00","first_seen_at":"2026-11-03T09:19:50+00:00","triaged_at":"2026-11-03T09:20:19+00:00","updated_at":"2026-11-03T09:20:19+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T09:20:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"pybddisasm: uninitialized output buffer can leak process memory on failure","impact":"medium","summary":"The pybddisasm Python bindings return an output buffer from nd_to_text even when text conversion fails, so the buffer may hold uninitialized data. An attacker who can reach an application that passes it failing inputs may read residual process memory or crash the Python process.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","pybddisasm","disassembly"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"process memory leaks or the Python process crashes","analyst_note":"Sources do not state a fixed version or replacement; check the NVD entry and the pybddisasm repository for maintainer guidance since the package is unmaintained.","how_to_check":"- `pip show pybddisasm` to see whether the package is installed and which version\n- Search the project for calls to `nd_to_text` whose results are returned or used when conversion fails\n- Confirm whether the application accepts invalid parameters from untrusted input","plain_action":"","needs_analyst":true,"not_affected_if":["no-nd_to_text-calls","trusted-input-only"],"who_is_affected":"Applications that import pybddisasm and call nd_to_text with parameters that can make conversion fail, then return or use the output. The package is no longer maintained, so no upstream fix is stated in the sources. Teams that do not call nd_to_text, or that never pass it untrusted or invalid input, are unlikely to be exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000711,"input_tokens":4194,"output_tokens":583,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118448':13A,16A '-2026':12A,15A 'affect':78C 'applic':51B,125C 'attack':46B 'bind':24B,77C 'buffer':4A,28B,40B,96C 'caus':90C,116C,135C 'convers':36B,86C,136C 'convert':103C 'crash':63B,121C 'cve':11A,14A 'data':44B 'disassembl':17B 'disclos':111C 'even':33B 'exploit':122C 'fail':37B,55B,87C,138C 'failur':10A,89C 'hold':42B 'includ':88C 'input':56B 'invalid':92C 'invok':127C 'leak':6A 'longer':153C 'maintain':154C 'may':41B,57B,97C,110C 'memori':8A,61B,71C,114C 'nd':30B,79C,128C 'otherwis':143C 'output':3A,27B,95C,147C 'packag':18B,150C 'paramet':93C 'pass':53B 'process':7A,60B,66B,113C,119C 'pybddisasm':1A,19B,22B,75C,149C 'python':20B,23B,65B,76C,106C,118C 'reach':49B 'read':58B 'remain':98C 'requir':123C 'residu':59B,112C 'result':146C 'return':25B,107C,141C 'still':101C 'text':32B,35B,81C,85C,130C 'under':84C 'uniniti':2A,43B,70C,99C 'use':68C,144C 'valu':108C 'vulner':72C 'way':133C","nicknames":[],"mitigations":[],"who_affected":"Applications that import pybddisasm and call nd_to_text with parameters that can make conversion fail, then return or use the output. The package is no longer maintained, so no upstream fix is stated in the sources. Teams that do not call nd_to_text, or that never pass it untrusted or invalid input, are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["disassembly","medium","package","pybddisasm","python"],"first_public_at":"2026-11-03T09:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-requests@bitdefender.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118448","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118448","severity":null,"published_at":"2026-11-03T09:17:11+00:00","modified_at":"2026-11-03T09:17:11+00:00","first_seen_at":"2026-11-03T09:19:50+00:00","fetched_at":"2026-11-03T09:19:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}