CVE-2026-118446 is a use-after-free vulnerability in the pybddisasm Python bindings affecting array-valued members of INSTRUX objects, such as ND_OPERAND arrays. These arrays are exposed as Python lists referencing memory owned by the parent INSTRUX object. Retaining references to list elements after the parent object is freed can lead to accessing freed memory, potentially causing crashes or exposure of process memory. Exploitation requires specific application behavior retaining and accessing these elements post-free. The pybddisasm package is no longer maintained.