Bitdefender has 6 CVEs on record between 2025 and 2026. 5 were published in the last 90 days. The busiest recent month was November 2026 with 5. The median CVSS is 6.9 (medium). None have a confirmed exploitation report. Most affected products: pybddisasm (5), antivirus (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.9
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Worst active — by depth score
CVE-2025-7073High· 7.8A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges43CVE-2026-118448Medium· 6.9Uninitialized output buffer returned after nd_to_text failure in pybddisasm38CVE-2026-118446Medium· 6.9Use-after-free in INSTRUX array members in pybddisasm38CVE-2026-118445Medium· 6.9Use-after-free in INSTRUX structure members in pybddisasm38CVE-2026-118447Medium· 4.8Uninitialized INSTRUX contents returned after decoding failure in pybddisasm26
Bitdefender vulnerabilities
CVEs affecting Bitdefender, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-118446Medium· 6.9Use-after-free in INSTRUX array members in pybddisasm
A use-after-free vulnerability in the pybddisasm Python bindings affects array-valued members of INSTRUX objects, including ND_OPERAND arrays. These arrays are exposed as Python lists whose elements reference memory owned by the parent I…
CVE-2026-118444Medium· 4.8Out-of-bounds reads during instruction decoding in pybddisasm
Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nd_decode function may read up to 15 bytes without checking the actual length of the supplied Pyth…
CVE-2026-118448Medium· 6.9Uninitialized output buffer returned after nd_to_text failure in pybddisasm
A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text. If the underlying text conversion fails, including failures caused by invalid parameters, the output buffer may remain uninitialized while …
CVE-2026-118445Medium· 6.9Use-after-free in INSTRUX structure members in pybddisasm
A use-after-free vulnerability in the pybddisasm Python bindings affects structure-valued members of INSTRUX objects. These members are exposed through Python objects that reference memory owned by the parent INSTRUX object. A retained r…
CVE-2026-118447Medium· 4.8Uninitialized INSTRUX contents returned after decoding failure in pybddisasm
A use of uninitialized memory vulnerability in the pybddisasm Python bindings may disclose process memory when instruction decoding fails. The nd_decode, nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions may return an INS…
CVE-2025-7073High· 7.8A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges
A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges. The issue arises from bdservicehost.exe deleting files from a user-writable dir…