Quick answers
- Is CVE-2026-118445 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-118445 being exploited in the wild.
- How severe is CVE-2026-118445?
- Informational severity, published 3 November 2026.
- Which products and versions are affected?
- pybddisasm pybddisasm.
- Is there a fix for CVE-2026-118445?
- No fixed version is recorded yet. The pybddisasm package is no longer maintained. Applications should discontinue use or consider migrating to actively maintained alternatives for instruction disassembly. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-118445 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-118445?
- Check whether you run Pybddisasm. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
The pybddisasm package is no longer maintained. Applications should discontinue use or consider migrating to actively maintained alternatives for instruction disassembly.
Technical details
The vulnerability is a use-after-free in pybddisasm's Python bindings where structure-valued members of INSTRUX objects maintain references to parent object memory without keeping the parent allocation alive. When the parent INSTRUX object is freed, a retained member reference accesses freed memory, which may leak process memory or crash the Python process depending on memory reuse. Exploitation requires the application to retain a member reference and subsequently access it after parent object destruction.
Affected products
- pybddisasm pybddisasm
Timeline
- 2026-11-03: disclosed