---
id: CVE-2026-118444
title: Out-of-bounds reads during instruction decoding in pybddisasm
summary: >-
  Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may
  disclose adjacent process memory during instruction decoding. The nd_decode
  function may read up to 15 bytes without checking the actual length of the
  supplied Pyth…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-125
vendor: Bitdefender
product: pybddisasm
affected:
  - pybddisasm <= 0.3.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T17:24:13.482628Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T18:32:44.913Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118444'
references:
  - url: 'https://pypi.org/project/pybddisasm/'
tags:
  - cve.org
epss: 0.00105
epssPercentile: 0.01049
ingestedAt: '2026-11-05T20:33:06.365Z'
---

## Overview

Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nd_decode function may read up to 15 bytes without checking the actual length of the supplied Python buffer. The nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions pass the caller-supplied buffer size to the decoder without validating it against the actual length of the Python buffer. Data read beyond the buffer may be exposed through nd_get_instrux_bytes, which returns a fixed-length list of 16 bytes. Exploitation requires an application to invoke the affected APIs with a short buffer or an oversized length and to expose the resulting bytes to an attacker. The pybddisasm package is no longer maintained.

## Affected

- `pybddisasm <= 0.3.0`

## Remediation

Discontinue use of the unmaintained pybddisasm package. No fixed release will become available..