UBUNTU-CVE-2026-118447: Medium severity ubuntu/python2.7 vulnerability
A use of uninitialized memory vulnerability in the pybddisasm Python bindings may disclose process memory when instruction decoding fails. The nddecode, nddecodeex, nddecodeex2, and nddecodewithcontext functions may return an INSTRUX object whose contents have not been initialized after an unsuccessful decoding operation, including failures caused by invalid parameters. Accessing members of the returned object may expose residual process memory. Exploitation requires an application to access and expose the returned object contents after a decoding failure. The pybddisasm package is no longer maintained.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using the pybddisasm Python bindings are exposed if they call nd_decode, nd_decode_ex, nd_decode_ex2, or nd_decode_with_context and then access or expose members of the returned INSTRUX object after decoding fails.
Can a failed decode alone disclose memory?
No. Disclosure requires the application to access and expose contents of the returned INSTRUX object after an unsuccessful decoding operation. Failures caused by invalid parameters are included.
Is an upstream fix expected for pybddisasm?
The package is no longer maintained. The provided data does not identify an available fix or a supported replacement.