CVE-2026-118447Medium· 4.8▾ SunlitA use of uninitialized memory vulnerability in the pybddisasm Python bindings may disclose process memory when instruction decoding fails. The nd_decode, nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions may return an INS…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 26.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
A use of uninitialized memory vulnerability in the pybddisasm Python bindings may disclose process memory when instruction decoding fails. The nd_decode, nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions may return an INSTRUX object whose contents have not been initialized after an unsuccessful decoding operation, including failures caused by invalid parameters. Accessing members of the returned object may expose residual process memory. Exploitation requires an application to access and expose the returned object contents after a decoding failure. The pybddisasm package is no longer maintained.
pybddisasm <= 0.3.0Discontinue use of the unmaintained pybddisasm package. No fixed release will become available.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118448Medium· 6.9Uninitialized output buffer returned after nd_to_text failure in pybddisasm
CVE-2026-118444Medium· 4.8Out-of-bounds reads during instruction decoding in pybddisasm
CVE-2026-118446Medium· 6.9Use-after-free in INSTRUX array members in pybddisasm
CVE-2026-118445Medium· 6.9Use-after-free in INSTRUX structure members in pybddisasm
CVE-2026-5888Medium· 6.5Uninitialized Use in WebCodecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page
CVE-2026-85068Low· 2.4NUT blazer_usb ippon_command stack info-leak via unzeroed char tmp[64] in OUT-direction usb_control_msg