Quick answers
- Is CVE-2026-118446 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-118446 being exploited in the wild.
- How severe is CVE-2026-118446?
- Informational severity, published 3 November 2026.
- Which products and versions are affected?
- pybddisasm pybddisasm.
- Is there a fix for CVE-2026-118446?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-118446 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-118446?
- Check whether you run Pybddisasm. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a use-after-free in Python bindings for the bddisasm disassembler: array-valued members of INSTRUX objects (such as ND_OPERAND arrays) are exposed as Python lists whose underlying memory is owned by the parent INSTRUX object, but the lists do not hold references that keep the parent alive. An attacker who controls an application's use of pybddisasm can craft input causing the application to retain array elements across parent object deletion, then dereference them. The impact ranges from information disclosure (reading freed memory) to process crash; no fix is available since the package is unmaintained.
Affected products
- pybddisasm pybddisasm
Timeline
- 2026-11-03: disclosed