Threats affecting pkg:pypi/pybddisasm

CVE-2026-118448 is a use of uninitialized memory vulnerability in the pybddisasm Python bindings of Bitdefender. It affects the nd_to_text function, where failure in text conversion can leave the output buffer uninitialized. This may lead to disclosure of residual process memory or cause the Python process to crash. Exploitation requires invoking nd_to_text with inputs that cause conversion failure and using the resulting output. The pybddisasm package is no longer maintained.

CVE-2026-118447 is a use of uninitialized memory vulnerability in the pybddisasm Python bindings by Bitdefender. When instruction decoding fails in certain functions, an object with uninitialized contents may be returned, potentially exposing residual process memory. Exploitation requires the application to access and expose these uninitialized contents after a decoding failure. The pybddisasm package is no longer maintained.

CVE-2026-118446 is a use-after-free vulnerability in the pybddisasm Python bindings of Bitdefender. It affects array-valued members of INSTRUX objects, such as ND_OPERAND arrays, which are exposed as Python lists referencing memory owned by the parent object. Retaining references to these lists or their elements after the parent INSTRUX object is freed can lead to accessing freed memory. This may expose process memory or cause the Python process to crash. The pybddisasm package is no longer maintained.

CVE-2026-118445 is a use-after-free vulnerability in the pybddisasm Python bindings of Bitdefender. It affects structure-valued members of INSTRUX objects, where references to these members can outlive the parent object, leading to access of freed memory. This can cause process crashes or exposure of process memory. The pybddisasm package is no longer maintained.

CVE-2026-118444 is an out-of-bounds read vulnerability in the pybddisasm Python bindings used by Bitdefender. The flaw occurs because certain decoding functions read beyond the actual length of the provided buffer, potentially disclosing adjacent process memory. Exploitation requires an application to call these APIs with a short buffer or an oversized length and then expose the resulting bytes to an attacker. The pybddisasm package is no longer maintained.