CVE-2026-118448 is a use of uninitialized memory vulnerability in the pybddisasm Python bindings affecting the nd_to_text function. When text conversion fails, including due to invalid parameters, the output buffer may remain uninitialized but still be returned to Python, potentially leaking residual process memory or causing a crash. Exploitation requires invoking nd_to_text with inputs that cause conversion failure and using the resulting output. The pybddisasm package is no longer maintained.