UBUNTU-CVE-2026-118444: Medium severity ubuntu/python2.7 vulnerability
Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nddecode function may read up to 15 bytes without checking the actual length of the supplied Python buffer. The nddecodeex, nddecodeex2, and nddecodewithcontext functions pass the caller-supplied buffer size to the decoder without validating it against the actual length of the Python buffer. Data read beyond the buffer may be exposed through ndgetinstruxbytes, which returns a fixed-length list of 16 bytes. Exploitation requires an application to invoke the affected APIs with a short buffer or an oversized length and to expose the resulting bytes to an attacker. The pybddisasm package is no longer maintained.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Applications using the pybddisasm Python bindings on the listed Ubuntu Python packages are exposed only if they call the affected decoding APIs and make returned instruction bytes available to an attacker. The package is no longer maintained.
What must an attacker be able to influence to exploit it?
An attacker needs an application path that invokes nd_decode with a short Python buffer, or invokes nd_decode_ex, nd_decode_ex2, or nd_decode_with_context with a caller-supplied size larger than the actual buffer. The application must then expose bytes returned through nd_get_instrux_bytes.
How can I determine whether my application is affected?
Review uses of nd_decode, nd_decode_ex, nd_decode_ex2, and nd_decode_with_context. The risky cases are short buffers passed to nd_decode and buffer-length arguments to the other APIs that are not validated against the actual Python buffer length.