CVE-2026-118444Medium· 4.8▾ SunlitOut-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nd_decode function may read up to 15 bytes without checking the actual length of the supplied Pyth…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 26.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nd_decode function may read up to 15 bytes without checking the actual length of the supplied Python buffer. The nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions pass the caller-supplied buffer size to the decoder without validating it against the actual length of the Python buffer. Data read beyond the buffer may be exposed through nd_get_instrux_bytes, which returns a fixed-length list of 16 bytes. Exploitation requires an application to invoke the affected APIs with a short buffer or an oversized length and to expose the resulting bytes to an attacker. The pybddisasm package is no longer maintained.
pybddisasm <= 0.3.0Discontinue use of the unmaintained pybddisasm package. No fixed release will become available..
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118446Medium· 6.9Use-after-free in INSTRUX array members in pybddisasm
CVE-2026-118445Medium· 6.9Use-after-free in INSTRUX structure members in pybddisasm
CVE-2026-118448Medium· 6.9Uninitialized output buffer returned after nd_to_text failure in pybddisasm
CVE-2026-118447Medium· 4.8Uninitialized INSTRUX contents returned after decoding failure in pybddisasm
CVE-2021-3506High· 7.1An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4
CVE-2019-11050Medium· 4.8When PHP EXIF extension is parsing EXIF information from an image, e.g