Skip to content
OpenAdvisories
Medium · 6.9 CVE-2026-118448 EUVD-2026-115700GHSA-9w8f-4c2r-vh34

Uninitialized output buffer returned after nd_to_text failure in pybddisasm

Published Nov 3, 2026 · Updated Nov 3, 2026 · Assigned by Bitdefender

Description

A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text. If the underlying text conversion fails, including failures caused by invalid parameters, the output buffer may remain uninitialized while still being converted into a Python return value. This may disclose residual process memory or cause the Python process to crash. Exploitation requires an application to invoke nd_to_text in a way that causes conversion to fail and to return or otherwise use the resulting output. The pybddisasm package is no longer maintained.

Affected products

VendorProductAffectedFixed
Bitdefender pybddisasm ≤ 0.3.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu 26.10 python3.14 No fix yet —
Ubuntu 26.04 LTS python3.14 No fix yet —
Ubuntu 24.04 LTS python3.12 No fix yet —
Ubuntu 22.04 LTS python3.10 No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS python2.7 +1 No fix yet —
Ubuntu Pro 20.04 LTS python2.7 +2 No fix yet —
Ubuntu Pro 18.04 LTS python2.7 +3 No fix yet —
Ubuntu Pro 16.04 LTS python2.7 +1 No fix yet —
Ubuntu Pro 14.04 LTS python2.7 +2 No fix yet —

References