CVE-2026-118448 in pybddisasm
Summary
by MITRE • 11/03/2026
A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text. If the underlying text conversion fails, including failures caused by invalid parameters, the output buffer may remain uninitialized while still being converted into a Python return value. This may disclose residual process memory or cause the Python process to crash. Exploitation requires an application to invoke nd_to_text in a way that causes conversion to fail and to return or otherwise use the resulting output. The pybddisasm package is no longer maintained.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as CVE-2024-38976 represents a critical memory safety flaw within the pybddisasm Python bindings, specifically affecting the nd_to_text function which is responsible for converting disassembly data into human-readable text strings. This issue stems from improper initialization of output buffers in scenarios where the underlying text conversion process encounters an error or fails due to invalid parameters provided by the caller. In a properly secured implementation, any failure path should ensure that memory buffers are either cleared before use or explicitly handled to prevent leakage of sensitive data. However, in this specific case, when the conversion logic aborts prematurely, the buffer retains its previous state from prior operations within the same process context rather than being zeroed out or marked as invalid for return.
This uninitialized memory usage directly maps to CWE-908, which describes the use of uninitialized resource, and often correlates with CWE-200, an information exposure vulnerability where sensitive data is disclosed through unintended channels. The operational impact of this flaw is twofold: it can lead to the disclosure of residual process memory contents that may contain secrets such as API keys, authentication tokens, or other proprietary logic from previous function calls within the same Python interpreter instance. Furthermore, if the uninitialized buffer contains garbage values that do not conform to expected string termination characters or valid UTF-8 sequences, it can trigger segmentation faults or general protection faults, resulting in a denial of service by crashing the hosting application.
Exploitation of this vulnerability requires an attacker-controlled input vector where they can invoke the nd_to_text function with parameters designed to force a conversion failure while ensuring that the uninitialized buffer is subsequently returned and processed by the calling Python code. This typically involves crafting specific inputs that trigger edge cases in the disassembly engine, such as malformed instruction encodings or out-of-bounds offsets. Once triggered, the application may inadvertently print, log, or transmit the contents of this memory region to an external observer or attacker, thereby facilitating information leakage. In environments where pybddisasm is used for automated analysis tools or sandboxing mechanisms, this could allow attackers to bypass security controls by extracting internal state information that was not intended to be exposed.
Given that the pybddisasm package has been declared unmaintained, remediation through patching is no longer a viable option for most users relying on this specific library version. Organizations and developers currently utilizing these bindings should immediately assess their dependency tree and consider migrating to alternative, actively maintained disassembly libraries such as angr, Keystone Engine, or Capstone with Python wrappers that have robust memory safety guarantees. If migration is not feasible in the short term, strict input validation must be implemented at the application layer to prevent passing invalid parameters to nd_to_text, thereby reducing the attack surface for triggering conversion failures. Additionally, running affected processes within restricted environments with limited memory access permissions can mitigate the severity of potential information disclosure by isolating the process from sensitive data stores.