Uninitialized output buffer returned after nd_to_text failure in pybddisasm

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text. If the underlying text conversion fails, including failures caused by invalid parameters, the output buffer may remain uninitialized while still being converted into a Python return value. This may disclose residual process memory or cause the Python process to crash. Exploitation requires an application to invoke nd_to_text in a way that causes conversion to fail and to return or otherwise use the resulting output. The pybddisasm package is no longer maintained.

Üreticinin çözüm notu (İngilizce)

Discontinue use of the unmaintained pybddisasm package. No fixed release will become available.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• pypi.org/project/pybddisasm Diğer

Kayıt geçmişi

1. 3 Kas 2026 12:01Yayımlandı

İlgili açıklar

• 4,8 CVE-2026-118447Uninitialized INSTRUX contents returned after decoding failure in pybddisasm
• 6,9 CVE-2026-118446Use-after-free in INSTRUX array members in pybddisasm
• 6,9 CVE-2026-118445Use-after-free in INSTRUX structure members in pybddisasm
• 4,8 CVE-2026-118444Out-of-bounds reads during instruction decoding in pybddisasm
• 2,4 CVE-2026-85068NUT blazer_usb ippon_command stack info-leak via unzeroed char tmp[64] in OUT-direction usb_control_msg
• 6,9 CVE-2026-54913WebAssembly Micro Runtime: Missing `ref.null` heap-type validation in `load_init_expr` leaks host stack memory to the WebAssembly guest