pybddisasm EUVD-2026-115704

Exploitation requires a host application that (1) invokes nd_decode with a Python buffer shorter than 15 bytes, or invokes nd_decode_ex, nd_decode_ex2, or nd_decode_with_context with a caller-supplied length larger than the actual Python buffer, and (2) exposes the resulting bytes to the attacker (e.g., by returning the fixed 16-byte list from nd_get_instrux_bytes). The flaw is therefore not self-contained in the library's default use: it is gated by how the integrating application supplies buffer/length arguments and whether it surfaces decoded bytes externally. Limiting factors per the CVSS vector: local access (AV:L) and low-privilege access (PR:L) are required, impact is confined to a small, bounded confidentiality leak (up to ~15 adjacent bytes), and no integrity or availability impact occurs. Because the package is no longer maintained, remediation depends on the integrating application avoiding or sanitizing these calls rather than on a vendor patch.

All quantitative signals point to a modest, non-urgent issue. The supplied CVSS 4.0 vector scores 4.8 (medium): AV:L (local), AC:L, AT:N, PR:L (low-privileged access required), UI:N, with impact limited to VC:L (low confidentiality) and no integrity or availability impact (VI:N/VA:N) and no scope change to subsequent systems. No EPSS probability was provided, the CVE is not listed in CISA KEV, and the only reference is the PyPI project page - there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', not act_now or emergency, consistent with a low-to-moderate priority. One signal worth flagging: CVSS marks the vector as local (AV:L), but the real attack surface depends entirely on the consuming application - if an application feeds attacker-controlled bytes into the affected APIs and returns the result over a network, the effective reachability could be remote; verify against the actual deployment. The disclosed data is bounded (the decoder may read up to 15 bytes, and nd_get_instrux_bytes returns a fixed 16-byte list), so this is a small adjacent-memory leak rather than a broad read primitive. A significant practical factor is that the pybddisasm package is no longer maintained, so no vendor fix is expected. Net: a real but low-severity information-disclosure bug whose exploitability is gated by how a given application uses the library.

An application that uses pybddisasm to decode instruction bytes supplied (directly or indirectly) by an attacker calls nd_decode with a buffer shorter than 15 bytes, or calls nd_decode_ex/nd_decode_ex2/nd_decode_with_context with a length larger than the actual Python buffer, and then exposes the decoded instruction via nd_get_instrux_bytes. The decoder reads past the end of the buffer into adjacent process memory, and those out-of-bounds bytes are returned to the attacker as part of the fixed 16-byte list. No public exploit code has been identified.