UBUNTU-CVE-2026-118448: Medium severity ubuntu/python2.7 vulnerability
A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects ndtotext. If the underlying text conversion fails, including failures caused by invalid parameters, the output buffer may remain uninitialized while still being converted into a Python return value. This may disclose residual process memory or cause the Python process to crash. Exploitation requires an application to invoke ndtotext in a way that causes conversion to fail and to return or otherwise use the resulting output. The pybddisasm package is no longer maintained.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
pybddisasmfrom your environment.Uninstall the unmaintained pybddisasm package.
Event History
Frequently Asked Questions
Which applications are exposed?
Applications using the pybddisasm Python bindings are exposed if they call nd_to_text and can cause the underlying text conversion to fail. The affected Ubuntu package listings include Python 2.7 and Python 3.4 through Python 3.9, as well as Python 3.14.
What must an attacker be able to do to trigger the issue?
They need to influence an application’s call to nd_to_text so that text conversion fails, such as through invalid parameters, and the application must return or otherwise use the resulting output. The issue is locally exploitable and requires low privileges; no user interaction is required.
What is the impact if conversion fails?
The output buffer can remain uninitialized but still be converted into a Python return value. This can disclose residual memory from the process or crash the Python process.
What can be done if an update is not available?
Avoid calling nd_to_text with inputs or parameters that can cause text conversion to fail, and do not return or consume output when conversion reports failure. The package is no longer maintained, so replacing or removing pybddisasm may be necessary.