{"id":"CVE-2026-118448","aliases":[],"cve":{"records":[{"id":"CVE-2026-118448","source":"Bitdefender","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":true,"reserved":"2026-10-28T08:25:09.716Z","published":"2026-11-03T09:01:33.191Z","modified":"2026-11-03T18:32:18.313Z"}],"publishers":[{"name":"Bitdefender","role":"CNA","organizationId":"b3d5ebe7-963e-41fb-98e1-2edaeabb8f82","modified":"2026-11-03T09:01:33.191Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-03T18:32:18.313Z"}],"references":[{"url":"https://pypi.org/project/pybddisasm/","tags":[],"source":"Bitdefender"}],"weaknesses":[{"id":"CWE-457","description":"CWE-457: Use of Uninitialized Variable","source":"Bitdefender"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-03T17:23:44.685430Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Uninitialized output buffer returned after nd_to_text failure in pybddisasm","titleSource":"Bitdefender","descriptionSource":"Bitdefender","description":"A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text. If the underlying text conversion fails, including failures caused by invalid parameters, the output buffer may remain uninitialized while still being converted into a Python return value. This may disclose residual process memory or cause the Python process to crash. Exploitation requires an application to invoke nd_to_text in a way that causes conversion to fail and to return or otherwise use the resulting output. The pybddisasm package is no longer maintained.","score":6.9,"severity":"medium","published":"2026-11-03T09:01:33.191Z","modified":"2026-11-03T18:32:18.313Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Bitdefender","name":"pybddisasm","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"0.3.0","versionType":"python"}],"defaultStatus":"unknown","cpes":[],"source":"Bitdefender","url":"https://www.cve.org/CVERecord?id=CVE-2026-118448"}],"remediation":[{"text":"Discontinue use of the unmaintained pybddisasm package. No fixed release will become available.","source":"Bitdefender","url":"https://www.cve.org/CVERecord?id=CVE-2026-118448"}],"references":["https://pypi.org/project/pybddisasm/"],"sources":[{"name":"CVE","id":"CVE-2026-118448","modified":"2026-11-03T18:32:18.313Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118448"}],"assessments":[{"source":"Bitdefender","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","score":6.9}],"sourceAffected":[],"observedAt":"2026-11-03T18:52:37.079Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:45:32.518Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-03T09:20:32.956Z","attemptedAt":"2026-11-03T09:20:32.956Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-03T09:20:32.811Z","attemptedAt":"2026-11-03T09:20:32.811Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-03T09:20:33.275Z","attemptedAt":"2026-11-03T09:20:33.275Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-03T09:20:33.275Z","attemptedAt":"2026-11-03T09:20:33.275Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-118448","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118448","modified":"2026-11-03T09:17:11.520","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-03T09:20:32.956Z"}],"aiSummary":{"text":"The pybddisasm package, version 0.3.0 or lower, has a use of uninitialized memory vulnerability in nd_to_text, potentially disclosing residual process memory or causing a crash if text conversion fails. Exploitation requires invoking nd_to_text with invalid parameters. The package is no longer maintained.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-03T09:16:01.812Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-118448"}]}}