# CVE-2026-118446: pybddisasm use-after-free in INSTRUX array members

Source: https://junglewise.ai/threats/cve-2026-118446-a-use-after-free-vulnerability-in-the-pybddisasm-python-bindings  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-118446 · Severity: info · Published 2026-11-03

The pybddisasm Python library, used for x86 instruction disassembly, contains a use-after-free vulnerability in how it exposes array members of disassembled instruction objects. An application that retains references to these arrays after the parent instruction object is freed can access freed memory, potentially exposing sensitive data or crashing the Python process. Since pybddisasm is no longer maintained, users have no patch available.

Technologies: [Pybddisasm](https://junglewise.ai/threats/technologies/pybddisasm-pybddisasm). Vendors: [Pybddisasm](https://junglewise.ai/threats/vendors/pybddisasm).

## Quick answers

**Is CVE-2026-118446 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118446 being exploited in the wild.

**How severe is CVE-2026-118446?** Informational severity, published 3 November 2026.

**Which products and versions are affected?** pybddisasm pybddisasm.

**Is there a fix for CVE-2026-118446?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-118446 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-118446?** Check whether you run Pybddisasm. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a use-after-free in Python bindings for the bddisasm disassembler: array-valued members of INSTRUX objects (such as ND_OPERAND arrays) are exposed as Python lists whose underlying memory is owned by the parent INSTRUX object, but the lists do not hold references that keep the parent alive. An attacker who controls an application's use of pybddisasm can craft input causing the application to retain array elements across parent object deletion, then dereference them. The impact ranges from information disclosure (reading freed memory) to process crash; no fix is available since the package is unmaintained.

## Affected products

- pybddisasm pybddisasm

## Timeline

- 2026-11-03: disclosed

## References

- [https://pypi.org/](https://pypi.org/)
- [https://pypi.org/project/pybddisasm/](https://pypi.org/project/pybddisasm/)

## Related threats

- [pybddisasm Python bindings use of uninitialized memory in nd_to_text](https://junglewise.ai/threats/cve-2026-118448-a-use-of-uninitialized-memory-vulnerability-in-the-pybddisasm)
- [pybddisasm use-after-free in INSTRUX member references](https://junglewise.ai/threats/cve-2026-118445-a-use-after-free-vulnerability-in-the-pybddisasm-python-bindings)