CVE-2026-118447 is a use of uninitialized memory vulnerability in the pybddisasm Python bindings. When instruction decoding functions fail, they may return objects containing uninitialized memory, potentially exposing residual process memory. Exploitation requires an application to access these returned objects after a decoding failure. The pybddisasm package is no longer maintained.