CVE-2026-118448Medium· 6.9▾ SunlitA use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text. If the underlying text conversion fails, including failures caused by invalid parameters, the output buffer may remain uninitialized while …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 38 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text. If the underlying text conversion fails, including failures caused by invalid parameters, the output buffer may remain uninitialized while still being converted into a Python return value. This may disclose residual process memory or cause the Python process to crash. Exploitation requires an application to invoke nd_to_text in a way that causes conversion to fail and to return or otherwise use the resulting output. The pybddisasm package is no longer maintained.
pybddisasm <= 0.3.0Discontinue use of the unmaintained pybddisasm package. No fixed release will become available.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118447Medium· 4.8Uninitialized INSTRUX contents returned after decoding failure in pybddisasm
CVE-2026-118444Medium· 4.8Out-of-bounds reads during instruction decoding in pybddisasm
CVE-2026-118446Medium· 6.9Use-after-free in INSTRUX array members in pybddisasm
CVE-2026-118445Medium· 6.9Use-after-free in INSTRUX structure members in pybddisasm
CVE-2026-5888Medium· 6.5Uninitialized Use in WebCodecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page
CVE-2026-85068Low· 2.4NUT blazer_usb ippon_command stack info-leak via unzeroed char tmp[64] in OUT-direction usb_control_msg