Uninitialized INSTRUX contents returned after decoding failure in pybddisasm

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

A use of uninitialized memory vulnerability in the pybddisasm Python bindings may disclose process memory when instruction decoding fails. The nd_decode, nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions may return an INSTRUX object whose contents have not been initialized after an unsuccessful decoding operation, including failures caused by invalid parameters. Accessing members of the returned object may expose residual process memory. Exploitation requires an application to access and expose the returned object contents after a decoding failure. The pybddisasm package is no longer maintained.

Üreticinin çözüm notu (İngilizce)

Discontinue use of the unmaintained pybddisasm package. No fixed release will become available.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• pypi.org/project/pybddisasm Diğer

Kayıt geçmişi

1. 3 Kas 2026 12:01Yayımlandı

İlgili açıklar

• 6,9 CVE-2026-118448Uninitialized output buffer returned after nd_to_text failure in pybddisasm
• 6,9 CVE-2026-118446Use-after-free in INSTRUX array members in pybddisasm
• 6,9 CVE-2026-118445Use-after-free in INSTRUX structure members in pybddisasm
• 4,8 CVE-2026-118444Out-of-bounds reads during instruction decoding in pybddisasm
• 2,4 CVE-2026-85068NUT blazer_usb ippon_command stack info-leak via unzeroed char tmp[64] in OUT-direction usb_control_msg
• 6,9 CVE-2026-54913WebAssembly Micro Runtime: Missing `ref.null` heap-type validation in `load_init_expr` leaks host stack memory to the WebAssembly guest