Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118447— Uninitialized INSTRUX contents returned after decoding failure in pybddisasm

Quick assessment

Affected
Bitdefender pybddisasm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

pybddisasm 的 Python 绑定中存在一处未初始化内存使用漏洞。当指令解码失败时，该漏洞可能导致进程内存信息泄露。具体而言，nd_decode、nd_decode_ex、nd_decode_ex2 和 nd_decode_with_context 函数在解码操作失败（包括因无效参数导致的失败）后，可能会返回一个其内容未经初始化的 INSTRUX 对象。若应用程序访问该返回对象的成员，可能会暴露残留的进程内存。利用此漏洞需要应用程序在解码失败后访问并暴露返回对象的内容。目前，pybddisasm 包已不再

CVSS 4.8 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-118447

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Uninitialized INSTRUX contents returned after decoding failure in pybddisasm
Source: CVE Program / CVE List V5
Vulnerability Description
A use of uninitialized memory vulnerability in the pybddisasm Python bindings may disclose process memory when instruction decoding fails. The nd_decode, nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions may return an INSTRUX object whose contents have not been initialized after an unsuccessful decoding operation, including failures caused by invalid parameters. Accessing members of the returned object may expose residual process memory. Exploitation requires an application to access and expose the returned object contents after a decoding failure. The pybddisasm package is no longer maintained.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用未经初始化的变量
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Bitdefender pybddisasm 0 ~ 0.3.0 -

II. Public POCs for CVE-2026-118447

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118447

请登录查看更多情报信息。

Other References for CVE-2026-118447 (1)

Same Patch Batch · Bitdefender · 2026-11-03 · 5 CVEs total

CVE-2026-118446 6.9 MEDIUM Use-after-free in INSTRUX array members in pybddisasm
CVE-2026-118448 6.9 MEDIUM Uninitialized output buffer returned after nd_to_text failure in pybddisasm
CVE-2026-118445 6.9 MEDIUM Use-after-free in INSTRUX structure members in pybddisasm
CVE-2026-118444 4.8 MEDIUM Out-of-bounds reads during instruction decoding in pybddisasm

IV. Related Vulnerabilities

Same product: pybddisasm
Same vendor: Bitdefender
Same weakness: CWE-457