A use‑after‑free flaw occurs in the Python bindings of pybddisasm. Structure‑valued members of INSTRUX objects expose pointers to memory that is owned by the parent object. If an application keeps a reference to such a member after the parent INSTRUX has been freed, the reference still points to deallocated memory. Accessing the member may leak process memory or crash the interpreter, representing a typical use‑after‑free (CWE‑416).

The affected item is the pybddisasm package from Bitdefender. No specific version information is provided, so all releases of pybddisasm are potentially vulnerable. The project is no longer maintained, meaning the risk remains as long as the package is used.

The CVSS base score of 6.9 signals a moderate severity, yet the EPSS score is not available, so the probability of real‑world exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, indicating no known exploits. Exploitation requires an application to retain a member reference after the parent object has been freed; thus only code that interacts with pybddisasm in this way can trigger the flaw. Without a maintenance fix, the risk remains if the package is deployed.