CVE-2026-118444 is an out-of-bounds read vulnerability in the pybddisasm Python bindings. The flaw occurs because certain decoding functions read beyond the supplied Python buffer without validating its actual length, potentially disclosing adjacent process memory. Exploitation requires an application to call these APIs with a short buffer or an oversized length and expose the resulting bytes to an attacker. The pybddisasm package is no longer maintained.