pybddisasm CVE-2026-118448

Exploitation requires an application to call the nd_to_text function of the pybddisasm bindings in a manner that causes the underlying text conversion to fail - for example via invalid parameters or malformed instruction data - and to then return or otherwise use the resulting output buffer; the uninitialized buffer is converted into a Python value only along this failure path. Limiting factors: the attacker needs local access and some privilege (CVSS PR:L), there is no network vector (AV:L), and exploitation is impossible unless an application actually embeds pybddisasm and exposes nd_to_text to attacker-influenceable input and consumes its output on the failure path. Because the package is no longer maintained, no vendor patch is expected; per the available evidence, migrating away from the package is the effective remediation.

This is a medium-severity, locally-scoped issue rather than a remote emergency. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N, score 6.9) describes a local attacker with some privilege, no user interaction, low complexity, resulting in low confidentiality impact (VC:L - residual memory disclosure) and high availability impact (VA:H - process crash), with no subsequent-system impact. The vuln.today decision label is 'this_month', not 'act_now' or 'emergency', which is consistent with a local information-disclosure/DoS flaw. No EPSS score, no CISA KEV listing, and no PoC/exploit reference were provided (the only reference is the PyPI project page), so there is no public exploitation signal to elevate priority. The signals are internally consistent - a low-privilege local flaw in a niche, unmaintained library - so there is no high-CVSS-but-low-real-risk contradiction to resolve; rather this is a moderate-CVSS, moderate-real-risk issue whose practical exposure depends entirely on whether a given application embeds pybddisasm and invokes nd_to_text on attacker-influenceable input. EPSS/KEV data being absent is expected here and is not itself a risk indicator.

An application that embeds the pybddisasm bindings calls nd_to_text on instruction data that an attacker can influence, crafting input (or invalid parameters) that makes the underlying text conversion fail. Because the output buffer is converted into a Python return value even when conversion failed and the buffer was never initialized, the application receives residual process memory - potentially leaking sensitive data from the heap/stack - or the Python process crashes. No public exploit code or PoC reference was provided in the input.