CVE-2026-118446

A use-after-free vulnerability in the pybddisasm Python bindings affects array-valued members of INSTRUX objects, including ND_OPERAND arrays. These arrays are exposed as Python lists whose elements reference memory owned by the parent INSTRUX object. Retaining a list or an element does not keep the parent allocation alive. Accessing an element after the parent INSTRUX object has been freed therefore accesses freed memory. Depending on how the element is used and whether the freed allocation has been reused, this may expose process memory or cause the Python process to crash. Exploitation requires an application to retain and subsequently access an array element after the parent object has been freed. The pybddisasm package is no longer maintained.

• CWE-416

• https://pypi.org/project/pybddisasm/

Published

Nov 3, 2026

Last Modified

Nov 3, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-118435Out-of-bounds write vulnerability in Samsung Open Source esc…5.4
• CVE-2026-118437The BuddyForms WordPress plugin before 2.10.1 does not prope…3.7
• CVE-2026-118438The Firelight Lightbox WordPress plugin before 2.3.24 does n…6.8
• CVE-2026-11844The iVEC-IEI Virtualization Edge Computer developed by IEI I…4.9
• CVE-2026-118444Out-of-bounds read vulnerabilities in the pybddisasm Python …4.8
• CVE-2026-118445A use-after-free vulnerability in the pybddisasm Python bind…6.9
• CVE-2026-118447A use of uninitialized memory vulnerability in the pybddisas…4.8
• CVE-2026-118448A use of uninitialized memory vulnerability in the pybddisas…6.9
• CVE-2026-11845The iVEC-IEI Virtualization Edge Computer developed by IEI I…7.2
• CVE-2026-11846The  iVEC-IEI Virtualization Edge Computer developed by IEI …8.1
• CVE-2026-11847The  iVEC-IEI Virtualization Edge Computer developed by IEI…4.3
• CVE-2026-118475A flaw was found in Eye of GNOME. When parsing a specially c…3.6