---
id: "CVE-2026-118448"
kind: "vulnerability"
aliases: ["CVE-2026-118448"]
title: "pybddisasm: uninitialized output buffer can leak process memory on failure"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["disassembly", "package", "pybddisasm", "python"]
not_affected_if: ["no-nd_to_text-calls", "trusted-input-only"]
published_at: "2026-11-03T09:17:11+00:00"
first_seen_at: "2026-11-03T09:19:50+00:00"
updated_at: "2026-11-03T09:20:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118448", "first_seen_at": "2026-11-03T09:19:50+00:00"}]
---

# pybddisasm: uninitialized output buffer can leak process memory on failure

The pybddisasm Python bindings return an output buffer from nd_to_text even when text conversion fails, so the buffer may hold uninitialized data. An attacker who can reach an application that passes it failing inputs may read residual process memory or crash the Python process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `pip show pybddisasm` to see whether the package is installed and which version
- Search the project for calls to `nd_to_text` whose results are returned or used when conversion fails
- Confirm whether the application accepts invalid parameters from untrusted input

## Timeline

- 2026-11-03T09:19:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118448

## From the sources

A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text. If the underlying text conversion fails, including failures caused by invalid parameters, the output buffer may remain uninitialized while still being converted into a Python return value. This may disclose residual process memory or cause the Python process to crash. Exploitation requires an application to invoke nd_to_text in a way that causes conversion to fail and to return or otherwise use the resulting output. The pybddisasm package is no longer maintained.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_