The pybddisasm package contains several functions that decode binary instructions from a Python buffer. The nd_decode function can read up to 15 bytes from the supplied buffer without verifying that the buffer actually contains that many bytes. Likewise, nd_decode_ex, nd_decode_ex2, and nd_decode_with_context forward the caller‑supplied length to the underlying decoder without validation. When the decoder reads beyond the end of the buffer, the bytes are later returned via nd_get_instrux_bytes as a 16‑byte slice. An attacker who can control the buffer size or the length parameter and can read the returned bytes can obtain data that belongs to adjacent memory, potentially leaking secrets or code. The vulnerability does not automatically lead to arbitrary code execution; it requires an application that uses the affected APIs with a short buffer or an incorrect length and that exposes the decoded bytes to the attacker.

The vulnerability affects the Bitdefender pybddisasm Python package. The package is no longer maintained and therefore cannot receive a patch. Any Python project that imports pybddisasm and calls the nd_decode family of functions is susceptible if it passes a buffer shorter than the length requested or an oversized length value.

The CVSS score of 4.8 indicates medium severity, mainly due to the disclosure that can be achieved only when the application exposes the decoder output. The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting no widespread exploitation yet. The likely attack path requires direct use of the vulnerable API from a trusted code base; remote attackers would need an application that provides untrusted data to these functions. In the absence of an exploitable path to privilege escalation or remote code execution, the risk is moderate but still requires attention to prevent accidental leakage of sensitive data.