The pybddisasm Python bindings contain a use‑of‑uninitialized‑memory flaw. If a decoding operation fails, functions such as nd_decode or nd_decode_ex can return an INSTRUX object whose members are not initialized. Reading those members exposes leftover content from the process's address space, potentially leaking sensitive data. The vulnerability is confined to the local environment of the application that uses the library, and exploitation requires the application to read the returned object after a failure.

The vulnerability affects Bitdefender’s pybddisasm library, an unmaintained Python package. All releases of pybddisasm are vulnerable because the issue is present in the code base and no patch has been issued.

The CVSS score of 4.8 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting low or uncertain exploitation prevalence. Attack vectors are limited to local code that uses the vulnerable functions; an attacker would need to induce a decoding failure and then process the returned object. Because the library is unmaintained, a developer must adopt a defensive posture rather than rely on upstream fixes.