EUVD-2026-115703
GHSA-xm87-hrrj-pq46
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local authenticated execution in app
-
DeliveryDecode instruction into INSTRUX object
-
ExploitRetain reference to structure-valued member
-
ExecutionFree parent INSTRUX object
-
PersistAccess member referencing freed memory
-
ImpactCrash process or disclose reused memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an application built on the pybddisasm bindings to (1) obtain a structure-valued member of an INSTRUX object as a Python object, (2) retain that member reference while the parent INSTRUX allocation is freed (the member does not keep the parent alive), and (3) subsequently access the stale member. There is no remote or unauthenticated path: the CVSS vector is AV:L with PR:L, so a local authenticated context running the vulnerable code is needed. Realistic impact is limited by this dependence on a specific, somewhat unusual application coding pattern, and by the product's rare, unmaintained footprint; memory disclosure (versus a mere crash) further depends on whether the freed allocation has been reused. |
| Impact | This is a moderate-severity, low-urgency issue rather than a top priority. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) describes a locally-triggered, authenticated flaw whose primary impact is availability (VA:H, process crash) with only limited confidentiality exposure (VC:L, possible disclosure of reused freed memory) and no integrity impact (VI:N) - consistent with a use-after-free (CWE-416) in a Python binding. No EPSS score was supplied, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public exploit was identified; exploitation status is 'no public exploit identified at time of analysis.' Critically, the flaw is not triggered by an external attacker against a service but by an application's own code pattern (retaining and later dereferencing a member after its parent INSTRUX object is freed), which sharply limits real-world attack surface. The vuln.today decision label 'this_month' aligns with a genuine-but-not-emergency posture. A complicating factor: the pybddisasm package is no longer maintained, so no vendor patch is expected - the only realistic remediation is a code/dependency change by consumers. |
| Exploit ScenarioDerived | An application using pybddisasm decodes an instruction into an INSTRUX object, keeps a Python reference to one of its structure-valued members, and allows the parent INSTRUX object to be garbage-collected or otherwise freed. When the application later accesses the retained member, it reads memory the parent no longer owns, crashing the Python process or, if the freed allocation has been reused, exposing residual process memory. No public exploit code was identified; the only supplied reference is the PyPI project page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Use-after-free in the unmaintained pybddisasm Python bindings lets a local, low-privileged process crash the Python interpreter or potentially read freed process memory when an application retains a structure-valued INSTRUX member reference after the parent object is freed. Exploitation requires a specific application coding pattern - obtaining a member object, letting the parent INSTRUX allocation be released, then accessing the stale member - and there is no remote or unauthenticated path. No public exploit has been identified at time of analysis, the package is no longer maintained, and the practical impact is limited by the narrow trigger and the library's small footprint.
RemediationAI
No vendor-released patch or fixed version has been identified at time of analysis, and because pybddisasm is no longer maintained, users should plan to migrate to a maintained disassembler binding or to the upstream bddisasm C library rather than wait for an update (package page: https://pypi.org/project/pybddisasm/). Where migration is not immediately possible, the actionable mitigation is to eliminate the stale-reference pattern in application code: copy structure-valued member data into independent Python objects (plain tuples, dicts or copied ctypes structures) while the parent INSTRUX is still alive, or hold an explicit strong reference to the parent INSTRUX for as long as any of its members are reachable. Copying adds per-access allocation overhead on hot decoding paths, while pinning the parent increases memory retention and can keep large allocations alive longer than intended; both must be applied consistently in every code path that touches member objects, since a single missed site reopens the use-after-free. Restricting use of the library to trusted, locally supplied binaries reduces exposure but does not remove the crash risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
pybddisasm wraps Bitdefender's bddisasm x86/x86-64 instruction decoder for Python. Several INSTRUX fields are structures rather than scalars, and the bindings expose them as Python objects that hold pointers into memory owned by the parent INSTRUX object rather than owning or referencing that memory. Because the member object does not keep the parent allocation alive, a Python-level reference to a member can outlive the INSTRUX it points into, producing a classic CWE-416 use-after-free: reads through the stale member either hit freed heap (possible memory disclosure, if the chunk has been reused) or unmapped/invalid data (interpreter crash). The trigger is application-driven and not described as reachable through any parsing of untrusted input alone; the supplied sources state only that an application must retain and later access a member reference after the parent is freed. Severity is bounded accordingly: the assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H - local access, low privileges, no user interaction, confidentiality impact limited to possible disclosure, and high availability impact from a crash.
Know when Pybddisasm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Local, in-process trigger (AV:L) within an authenticated application context (PR:L); crash dominates (A:H) with limited freed-memory disclosure (C:L) and no integrity impact.
Primary rating from Vendor (Bitdefender).
CVSS VectorVendor: Bitdefender
DescriptionCVE.org
A use-after-free vulnerability in the pybddisasm Python bindings affects structure-valued members of INSTRUX objects. These members are exposed through Python objects that reference memory owned by the parent INSTRUX object. A retained reference to a member does not keep the parent allocation alive. Accessing the member after the parent INSTRUX object has been freed therefore accesses freed memory. Depending on how the member is used and whether the freed allocation has been reused, this may expose process memory or cause the Python process to crash. Exploitation requires an application to retain and subsequently access a member reference after the parent object has been freed. The pybddisasm package is no longer maintained.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Pybddisasm
View allUninitialized-memory handling in the pybddisasm Python bindings can cause nd_to_text to turn an uninitialized output buf
A use-after-free in the pybddisasm Python bindings lets a local, low-privileged consumer of the library read freed heap
pybddisasm 0.3.0 and earlier can disclose residual process memory to any consuming application that reads an INSTRUX obj
Out-of-bounds reads in the pybddisasm Python bindings for the Bitdefender disassembler can expose up to roughly 15 bytes
Exploit-DB