The vulnerability resides in the python bindings of pybddisasm and allows a use‑after‑free on array members of INSTRUX objects. When an application keeps references to a list or element after the INSTRUX parent has been freed, the references point to reclaimed memory. If the freed memory region is overwritten or accessed, the process may crash or leak sensitive memory contents.

Bitdefender’s pybddisasm Python package is the affected product. No specific version information is available and the package is no longer maintained, increasing the risk of undispatched issues in all environments that still use it.

With a CVSS score of 6.9 the risk is medium. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the application to retain and later dereference an array element after its parent has been freed; therefore the attack vector is most likely local process manipulation, not remote code execution.