{"id":"CVE-2026-118444","aliases":["EUVD-2026-115704","GHSA-p5f7-36qg-83fr","UBUNTU-CVE-2026-118444"],"status":"published","title":"Out-of-bounds reads during instruction decoding in pybddisasm","description":"Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nd_decode function may read up to 15 bytes without checking the actual length of the supplied Python buffer. The nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions pass the caller-supplied buffer size to the decoder without validating it against the actual length of the Python buffer. Data read beyond the buffer may be exposed through nd_get_instrux_bytes, which returns a fixed-length list of 16 bytes. Exploitation requires an application to invoke the affected APIs with a short buffer or an oversized length and to expose the resulting bytes to an attacker. The pybddisasm package is no longer maintained.","severity":{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00105,"percentile":0.01046,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-125"],"published":"2026-11-03T09:00:36Z","modified":"2026-11-05T04:42:51Z","affected":[{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.5-8ubuntu3","2.7.5-8ubuntu4","2.7.6-2","2.7.6-2ubuntu1","2.7.6-3","2.7.6-3ubuntu1","2.7.6-4","2.7.6-4ubuntu1","2.7.6-5","2.7.6-7","2.7.6-8","2.7.6-8ubuntu0.2","2.7.6-8ubuntu0.3","2.7.6-8ubuntu0.4","2.7.6-8ubuntu0.5","2.7.6-8ubuntu0.6+esm2","2.7.6-8ubuntu0.6+esm3","2.7.6-8ubuntu0.6+esm5","2.7.6-8ubuntu0.6+esm6","2.7.6-8ubuntu0.6+esm7","2.7.6-8ubuntu0.6+esm8","2.7.6-8ubuntu0.6+esm9","2.7.6-8ubuntu0.6+esm10","2.7.6-8ubuntu0.6+esm11","2.7.6-8ubuntu0.6+esm12","2.7.6-8ubuntu0.6+esm13","2.7.6-8ubuntu0.6+esm14","2.7.6-8ubuntu0.6+esm15","2.7.6-8ubuntu0.6+esm16","2.7.6-8ubuntu0.6+esm17","2.7.6-8ubuntu0.6+esm18","2.7.6-8ubuntu0.6+esm20","2.7.6-8ubuntu0.6+esm21","2.7.6-8ubuntu0.6+esm22","2.7.6-8ubuntu0.6+esm24","2.7.6-8ubuntu0.6+esm25","2.7.6-8ubuntu0.6+esm26","2.7.6-8ubuntu0.6+esm28","2.7.6-8ubuntu0.6+esm29","2.7.6-8ubuntu0.6+esm30"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python3.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4~b1-0ubuntu3","3.4~b1-4ubuntu4","3.4~b1-4ubuntu6","3.4~b1-5ubuntu2","3.4~b2-1","3.4~b3-1ubuntu1","3.4~rc1-1build1","3.4~rc2-1","3.4~rc3-0ubuntu1","3.4.0-1","3.4.0-2ubuntu1","3.4.0-2ubuntu1.1","3.4.3-1ubuntu1~14.04.1","3.4.3-1ubuntu1~14.04.3","3.4.3-1ubuntu1~14.04.4","3.4.3-1ubuntu1~14.04.5","3.4.3-1ubuntu1~14.04.6","3.4.3-1ubuntu1~14.04.7","3.4.3-1ubuntu1~14.04.7+esm2","3.4.3-1ubuntu1~14.04.7+esm4","3.4.3-1ubuntu1~14.04.7+esm6","3.4.3-1ubuntu1~14.04.7+esm7","3.4.3-1ubuntu1~14.04.7+esm8","3.4.3-1ubuntu1~14.04.7+esm10","3.4.3-1ubuntu1~14.04.7+esm11","3.4.3-1ubuntu1~14.04.7+esm12","3.4.3-1ubuntu1~14.04.7+esm13","3.4.3-1ubuntu1~14.04.7+esm14","3.4.3-1ubuntu1~14.04.7+esm15","3.4.3-1ubuntu1~14.04.7+esm16","3.4.3-1ubuntu1~14.04.7+esm17","3.4.3-1ubuntu1~14.04.7+esm19","3.4.3-1ubuntu1~14.04.7+esm20","3.4.3-1ubuntu1~14.04.7+esm21"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python3.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.2-2ubuntu0~16.04.4~14.04.1","3.5.2-2ubuntu0~16.04.4~14.04.1+esm1","3.5.2-2ubuntu0~16.04.4~14.04.1+esm3","3.5.2-2ubuntu0~16.04.4~14.04.1+esm4","3.5.2-2ubuntu0~16.04.4~14.04.1+esm5","3.5.2-2ubuntu0~16.04.4~14.04.1+esm6","3.5.2-2ubuntu0~16.04.4~14.04.1+esm7","3.5.2-2ubuntu0~16.04.4~14.04.1+esm8","3.5.2-2ubuntu0~16.04.4~14.04.1+esm9","3.5.2-2ubuntu0~16.04.4~14.04.1+esm10","3.5.2-2ubuntu0~16.04.4~14.04.1+esm11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.10-4ubuntu1","2.7.10-4ubuntu2","2.7.11-2","2.7.11-3","2.7.11-4","2.7.11-6","2.7.11-7","2.7.11-7ubuntu1","2.7.12-1~16.04","2.7.12-1ubuntu0~16.04.1","2.7.12-1ubuntu0~16.04.2","2.7.12-1ubuntu0~16.04.3","2.7.12-1ubuntu0~16.04.4","2.7.12-1ubuntu0~16.04.8","2.7.12-1ubuntu0~16.04.9","2.7.12-1ubuntu0~16.04.11","2.7.12-1ubuntu0~16.04.12","2.7.12-1ubuntu0~16.04.13","2.7.12-1ubuntu0~16.04.14","2.7.12-1ubuntu0~16.04.16","2.7.12-1ubuntu0~16.04.18","2.7.12-1ubuntu0~16.04.18+esm1","2.7.12-1ubuntu0~16.04.18+esm2","2.7.12-1ubuntu0~16.04.18+esm3","2.7.12-1ubuntu0~16.04.18+esm4","2.7.12-1ubuntu0~16.04.18+esm5","2.7.12-1ubuntu0~16.04.18+esm6","2.7.12-1ubuntu0~16.04.18+esm7","2.7.12-1ubuntu0~16.04.18+esm8","2.7.12-1ubuntu0~16.04.18+esm9","2.7.12-1ubuntu0~16.04.18+esm10","2.7.12-1ubuntu0~16.04.18+esm11","2.7.12-1ubuntu0~16.04.18+esm12","2.7.12-1ubuntu0~16.04.18+esm13","2.7.12-1ubuntu0~16.04.18+esm15","2.7.12-1ubuntu0~16.04.18+esm16","2.7.12-1ubuntu0~16.04.18+esm17","2.7.12-1ubuntu0~16.04.18+esm18","2.7.12-1ubuntu0~16.04.18+esm19","2.7.12-1ubuntu0~16.04.18+esm20","2.7.12-1ubuntu0~16.04.18+esm21","2.7.12-1ubuntu0~16.04.18+esm22"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python3.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.0-3","3.5.0-3ubuntu1","3.5.1~rc1-2ubuntu1","3.5.1-1","3.5.1-2","3.5.1-3","3.5.1-5","3.5.1-6ubuntu1","3.5.1-6ubuntu2","3.5.1-9ubuntu1","3.5.1-10","3.5.2-2~16.01","3.5.2-2~16.04","3.5.2-2ubuntu0~16.04.1","3.5.2-2ubuntu0~16.04.2","3.5.2-2ubuntu0~16.04.3","3.5.2-2ubuntu0~16.04.4","3.5.2-2ubuntu0~16.04.5","3.5.2-2ubuntu0~16.04.8","3.5.2-2ubuntu0~16.04.9","3.5.2-2ubuntu0~16.04.10","3.5.2-2ubuntu0~16.04.11","3.5.2-2ubuntu0~16.04.12","3.5.2-2ubuntu0~16.04.13","3.5.2-2ubuntu0~16.04.13+esm1","3.5.2-2ubuntu0~16.04.13+esm2","3.5.2-2ubuntu0~16.04.13+esm3","3.5.2-2ubuntu0~16.04.13+esm5","3.5.2-2ubuntu0~16.04.13+esm6","3.5.2-2ubuntu0~16.04.13+esm7","3.5.2-2ubuntu0~16.04.13+esm8","3.5.2-2ubuntu0~16.04.13+esm9","3.5.2-2ubuntu0~16.04.13+esm10","3.5.2-2ubuntu0~16.04.13+esm11","3.5.2-2ubuntu0~16.04.13+esm12","3.5.2-2ubuntu0~16.04.13+esm13","3.5.2-2ubuntu0~16.04.13+esm14","3.5.2-2ubuntu0~16.04.13+esm15","3.5.2-2ubuntu0~16.04.13+esm16","3.5.2-2ubuntu0~16.04.13+esm17","3.5.2-2ubuntu0~16.04.13+esm18","3.5.2-2ubuntu0~16.04.13+esm19","3.5.2-2ubuntu0~16.04.13+esm20","3.5.2-2ubuntu0~16.04.13+esm21","3.5.2-2ubuntu0~16.04.13+esm22","3.5.2-2ubuntu0~16.04.13+esm23","3.5.2-2ubuntu0~16.04.13+esm24","3.5.2-2ubuntu0~16.04.13+esm25"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.14-2ubuntu2","2.7.14-4","2.7.14-6","2.7.14-7","2.7.14-8","2.7.15~rc1-1","2.7.15~rc1-1ubuntu0.1","2.7.15-4ubuntu4~18.04","2.7.15-4ubuntu4~18.04.1","2.7.15-4ubuntu4~18.04.2","2.7.17-1~18.04","2.7.17-1~18.04ubuntu1","2.7.17-1~18.04ubuntu1.1","2.7.17-1~18.04ubuntu1.2","2.7.17-1~18.04ubuntu1.3","2.7.17-1~18.04ubuntu1.5","2.7.17-1~18.04ubuntu1.6","2.7.17-1~18.04ubuntu1.7","2.7.17-1~18.04ubuntu1.8","2.7.17-1~18.04ubuntu1.10","2.7.17-1~18.04ubuntu1.11","2.7.17-1~18.04ubuntu1.13","2.7.17-1~18.04ubuntu1.13+esm1","2.7.17-1~18.04ubuntu1.13+esm2","2.7.17-1~18.04ubuntu1.13+esm3","2.7.17-1~18.04ubuntu1.13+esm4","2.7.17-1~18.04ubuntu1.13+esm5","2.7.17-1~18.04ubuntu1.13+esm6","2.7.17-1~18.04ubuntu1.13+esm7","2.7.17-1~18.04ubuntu1.13+esm8","2.7.17-1~18.04ubuntu1.13+esm10","2.7.17-1~18.04ubuntu1.13+esm11","2.7.17-1~18.04ubuntu1.13+esm12","2.7.17-1~18.04ubuntu1.13+esm13","2.7.17-1~18.04ubuntu1.13+esm14","2.7.17-1~18.04ubuntu1.13+esm15"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python3.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.3-1ubuntu1","3.6.4~rc1-1","3.6.4~rc1-2","3.6.4-1","3.6.4-2","3.6.4-3build1","3.6.4-4","3.6.5~rc1-1","3.6.5-3","3.6.6-1~18.04","3.6.7-1~18.04","3.6.8-1~18.04.1","3.6.8-1~18.04.2","3.6.8-1~18.04.3","3.6.9-1~18.04","3.6.9-1~18.04ubuntu1","3.6.9-1~18.04ubuntu1.1","3.6.9-1~18.04ubuntu1.3","3.6.9-1~18.04ubuntu1.4","3.6.9-1~18.04ubuntu1.6","3.6.9-1~18.04ubuntu1.7","3.6.9-1~18.04ubuntu1.8","3.6.9-1~18.04ubuntu1.9","3.6.9-1~18.04ubuntu1.10","3.6.9-1~18.04ubuntu1.12","3.6.9-1~18.04ubuntu1.13","3.6.9-1~18.04ubuntu1.13+esm1","3.6.9-1~18.04ubuntu1.13+esm2","3.6.9-1~18.04ubuntu1.13+esm3","3.6.9-1~18.04ubuntu1.13+esm4","3.6.9-1~18.04ubuntu1.13+esm5","3.6.9-1~18.04ubuntu1.13+esm6","3.6.9-1~18.04ubuntu1.13+esm7","3.6.9-1~18.04ubuntu1.13+esm8","3.6.9-1~18.04ubuntu1.13+esm9","3.6.9-1~18.04ubuntu1.13+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python3.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.0~a2-1","3.7.0~a3-1","3.7.0~a3-2","3.7.0~a3-3","3.7.0~a4-1","3.7.0~b1-1","3.7.0~b1-1build1","3.7.0~b2-1","3.7.0~b3-1","3.7.0-1~18.04","3.7.1-1~18.04","3.7.3-2~18.04.1","3.7.5-2~18.04","3.7.5-2~18.04.4","3.7.5-2ubuntu1~18.04.2","3.7.5-2ubuntu1~18.04.2+esm1","3.7.5-2ubuntu1~18.04.2+esm2","3.7.5-2ubuntu1~18.04.2+esm3","3.7.5-2ubuntu1~18.04.2+esm4","3.7.5-2ubuntu1~18.04.2+esm5","3.7.5-2ubuntu1~18.04.2+esm6","3.7.5-2ubuntu1~18.04.2+esm7","3.7.5-2ubuntu1~18.04.2+esm8","3.7.5-2ubuntu1~18.04.2+esm9","3.7.5-2ubuntu1~18.04.2+esm10","3.7.5-2ubuntu1~18.04.2+esm11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python3.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.0-3~18.04","3.8.0-3~18.04.1","3.8.0-3ubuntu1~18.04.2","3.8.0-3ubuntu1~18.04.2+esm1","3.8.0-3ubuntu1~18.04.2+esm2","3.8.0-3ubuntu1~18.04.2+esm3","3.8.0-3ubuntu1~18.04.2+esm4","3.8.0-3ubuntu1~18.04.2+esm5","3.8.0-3ubuntu1~18.04.2+esm6","3.8.0-3ubuntu1~18.04.2+esm7","3.8.0-3ubuntu1~18.04.2+esm8","3.8.0-3ubuntu1~18.04.2+esm9","3.8.0-3ubuntu1~18.04.2+esm10","3.8.0-3ubuntu1~18.04.2+esm11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python3.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.0-1","3.8.0-2","3.8.0-3","3.8.0-4","3.8.0-5","3.8.1-2ubuntu3","3.8.2~rc1-1ubuntu1","3.8.2-1","3.8.2-1ubuntu1","3.8.2-1ubuntu1.1","3.8.2-1ubuntu1.2","3.8.5-1~20.04","3.8.5-1~20.04.2","3.8.5-1~20.04.3","3.8.10-0ubuntu1~20.04","3.8.10-0ubuntu1~20.04.1","3.8.10-0ubuntu1~20.04.2","3.8.10-0ubuntu1~20.04.4","3.8.10-0ubuntu1~20.04.5","3.8.10-0ubuntu1~20.04.6","3.8.10-0ubuntu1~20.04.7","3.8.10-0ubuntu1~20.04.8","3.8.10-0ubuntu1~20.04.9","3.8.10-0ubuntu1~20.04.10","3.8.10-0ubuntu1~20.04.11","3.8.10-0ubuntu1~20.04.12","3.8.10-0ubuntu1~20.04.13","3.8.10-0ubuntu1~20.04.14","3.8.10-0ubuntu1~20.04.15","3.8.10-0ubuntu1~20.04.16","3.8.10-0ubuntu1~20.04.17","3.8.10-0ubuntu1~20.04.18","3.8.10-0ubuntu1~20.04.18+esm1","3.8.10-0ubuntu1~20.04.18+esm2","3.8.10-0ubuntu1~20.04.18+esm3","3.8.10-0ubuntu1~20.04.18+esm4","3.8.10-0ubuntu1~20.04.18+esm5","3.8.10-0ubuntu1~20.04.18+esm6","3.8.10-0ubuntu1~20.04.18+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.17~rc1-1","2.7.17-1","2.7.17-1ubuntu5","2.7.17-1ubuntu6","2.7.18~rc1-2","2.7.18-1~20.04","2.7.18-1~20.04.1","2.7.18-1~20.04.1+esm1","2.7.18-1~20.04.3","2.7.18-1~20.04.3+esm1","2.7.18-1~20.04.4","2.7.18-1~20.04.4+esm1","2.7.18-1~20.04.4+esm2","2.7.18-1~20.04.4+esm3","2.7.18-1~20.04.5","2.7.18-1~20.04.5+esm1","2.7.18-1~20.04.5+esm2","2.7.18-1~20.04.6","2.7.18-1~20.04.6+esm1","2.7.18-1~20.04.7","2.7.18-1~20.04.7+esm3","2.7.18-1~20.04.7+esm4","2.7.18-1~20.04.7+esm6","2.7.18-1~20.04.7+esm7","2.7.18-1~20.04.7+esm8","2.7.18-1~20.04.7+esm9","2.7.18-1~20.04.7+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python3.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.9.0~rc1-1~20.04","3.9.0-5~20.04","3.9.5-3~20.04.1","3.9.5-3ubuntu0~20.04.1","3.9.5-3ubuntu0~20.04.1+esm1","3.9.5-3ubuntu0~20.04.1+esm2","3.9.5-3ubuntu0~20.04.1+esm3","3.9.5-3ubuntu0~20.04.1+esm4","3.9.5-3ubuntu0~20.04.1+esm5","3.9.5-3ubuntu0~20.04.1+esm6","3.9.5-3ubuntu0~20.04.1+esm7","3.9.5-3ubuntu0~20.04.1+esm8","3.9.5-3ubuntu0~20.04.1+esm9","3.9.5-3ubuntu0~20.04.1+esm10","3.9.5-3ubuntu0~20.04.1+esm11"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python3.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.0-2","3.10.0-3","3.10.0-4","3.10.0-5","3.10.0-5build1","3.10.1-1","3.10.1-2","3.10.2-1","3.10.2-5","3.10.2-7","3.10.3-1","3.10.4-3","3.10.4-3ubuntu0.1","3.10.6-1~22.04","3.10.6-1~22.04.1","3.10.6-1~22.04.2","3.10.6-1~22.04.2ubuntu1","3.10.6-1~22.04.2ubuntu1.1","3.10.12-1~22.04.2","3.10.12-1~22.04.3","3.10.12-1~22.04.4","3.10.12-1~22.04.5","3.10.12-1~22.04.6","3.10.12-1~22.04.7","3.10.12-1~22.04.8","3.10.12-1~22.04.9","3.10.12-1~22.04.10","3.10.12-1~22.04.11","3.10.12-1~22.04.12","3.10.12-1~22.04.13","3.10.12-1~22.04.14","3.10.12-1~22.04.15","3.10.12-1~22.04.16","3.10.12-1~22.04.17","3.10.12-1~22.04.18"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python2.7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.18-8build1","2.7.18-13","2.7.18-13ubuntu1","2.7.18-13ubuntu1.1","2.7.18-13ubuntu1.1+esm2","2.7.18-13ubuntu1.2","2.7.18-13ubuntu1.2+esm1","2.7.18-13ubuntu1.2+esm2","2.7.18-13ubuntu1.2+esm3","2.7.18-13ubuntu1.3","2.7.18-13ubuntu1.3+esm1","2.7.18-13ubuntu1.4","2.7.18-13ubuntu1.4+esm1","2.7.18-13ubuntu1.5","2.7.18-13ubuntu1.5+esm2","2.7.18-13ubuntu1.5+esm3","2.7.18-13ubuntu1.5+esm5","2.7.18-13ubuntu1.5+esm6","2.7.18-13ubuntu1.5+esm7","2.7.18-13ubuntu1.5+esm8","2.7.18-13ubuntu1.5+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python3.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.11.0~rc1-1~22.04","3.11.0~rc1-1~22.04.1~esm1","3.11.0~rc1-1~22.04.1~esm2","3.11.0~rc1-1~22.04.1~esm3","3.11.0~rc1-1~22.04.1~esm4","3.11.0~rc1-1~22.04.1~esm5","3.11.0~rc1-1~22.04.1~esm6","3.11.0~rc1-1~22.04.1~esm7","3.11.0~rc1-1~22.04.1~esm8","3.11.0~rc1-1~22.04.1~esm9","3.11.0~rc1-1~22.04.1","3.11.0~rc1-1~22.04.1+esm1","3.11.0~rc1-1~22.04.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python3.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.12.0-1","3.12.0-5","3.12.0-6","3.12.0-7","3.12.1-2","3.12.2-1","3.12.2-4build3","3.12.2-4build4","3.12.2-5ubuntu3","3.12.3-1","3.12.3-1ubuntu0.1","3.12.3-1ubuntu0.2","3.12.3-1ubuntu0.3","3.12.3-1ubuntu0.4","3.12.3-1ubuntu0.5","3.12.3-1ubuntu0.6","3.12.3-1ubuntu0.7","3.12.3-1ubuntu0.8","3.12.3-1ubuntu0.9","3.12.3-1ubuntu0.10","3.12.3-1ubuntu0.11","3.12.3-1ubuntu0.12","3.12.3-1ubuntu0.13","3.12.3-1ubuntu0.15","3.12.3-1ubuntu0.16","3.12.3-1ubuntu0.17"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python3.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.14.4-1","3.14.6-1","3.14.7-1ubuntu1","3.14.7-4ubuntu1","3.14.7-4ubuntu2","3.14.7-5ubuntu1","3.14.8-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python3.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.14.0-1","3.14.0-2","3.14.0-4","3.14.2-1","3.14.3-1","3.14.3-2","3.14.3-3","3.14.3-5","3.14.4-1","3.14.4-1ubuntu0.1","3.14.4-1ubuntu0.2"]}],"products":[{"vendor":"bitdefender","product":"pybddisasm"}],"references":[{"url":"https://pypi.org/project/pybddisasm/","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118444"},{"url":"https://pypi.org/project/pybddisasm"},{"url":"https://github.com/advisories/GHSA-p5f7-36qg-83fr"},{"url":"https://ubuntu.com/security/CVE-2026-118444","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-118444","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-118444","title":"Out-of-bounds reads during instruction decoding in pybddisasm","description":"Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nd_decode function may read up to 15 bytes without checking the actual length of the supplied Python buffer. The nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions pass the caller-supplied buffer size to the decoder without validating it against the actual length of the Python buffer. Data read beyond the buffer may be exposed through nd_get_instrux_bytes, which returns a fixed-length list of 16 bytes. Exploitation requires an application to invoke the affected APIs with a short buffer or an oversized length and to expose the resulting bytes to an attacker. The pybddisasm package is no longer maintained.","status":"published","published":"2026-11-03T09:00:36.256Z","modified":"2026-11-03T18:32:44.913Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-03T20:02:16.924578Z"}],"euvd":[{"id":"EUVD-2026-115704","description":"Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nd_decode function may read up to 15 bytes without checking the actual length of the supplied Python buffer. The nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions pass the caller-supplied buffer size to the decoder without validating it against the actual length of the Python buffer. Data read beyond the buffer may be exposed through nd_get_instrux_bytes, which returns a fixed-length list of 16 bytes. Exploitation requires an application to invoke the affected APIs with a short buffer or an oversized length and to expose the resulting bytes to an attacker. The pybddisasm package is no longer maintained.","status":"published","published":"2026-11-03T09:00:36Z","modified":"2026-11-03T18:32:44Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-03T20:20:08.621391Z"}],"ghsa":[{"id":"GHSA-p5f7-36qg-83fr","title":"Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent...","description":"Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nd_decode function may read up to 15 bytes without checking the actual length of the supplied Python buffer. The nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions pass the caller-supplied buffer size to the decoder without validating it against the actual length of the Python buffer. Data read beyond the buffer may be exposed through nd_get_instrux_bytes, which returns a fixed-length list of 16 bytes. Exploitation requires an application to invoke the affected APIs with a short buffer or an oversized length and to expose the resulting bytes to an attacker. The pybddisasm package is no longer maintained.","status":"published","published":"2026-11-03T09:31:45Z","modified":"2026-11-03T09:31:53Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-03T09:50:56.938855Z"}],"nvd":[{"id":"CVE-2026-118444","description":"Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nd_decode function may read up to 15 bytes without checking the actual length of the supplied Python buffer. The nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions pass the caller-supplied buffer size to the decoder without validating it against the actual length of the Python buffer. Data read beyond the buffer may be exposed through nd_get_instrux_bytes, which returns a fixed-length list of 16 bytes. Exploitation requires an application to invoke the affected APIs with a short buffer or an oversized length and to expose the resulting bytes to an attacker. The pybddisasm package is no longer maintained.","status":"published","published":"2026-11-03T09:17:10.937Z","modified":"2026-11-03T19:17:54.683Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-03T22:58:51.822037Z"}],"osv":[{"id":"UBUNTU-CVE-2026-118444","description":"Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nd_decode function may read up to 15 bytes without checking the actual length of the supplied Python buffer. The nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions pass the caller-supplied buffer size to the decoder without validating it against the actual length of the Python buffer. Data read beyond the buffer may be exposed through nd_get_instrux_bytes, which returns a fixed-length list of 16 bytes. Exploitation requires an application to invoke the affected APIs with a short buffer or an oversized length and to expose the resulting bytes to an attacker. The pybddisasm package is no longer maintained.","status":"published","published":"2026-11-03T09:17:00Z","modified":"2026-11-05T04:42:51Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-05T13:33:25.727744Z"}]}}