The vulnerability arises when the nd_to_text conversion function fails, leaving the output buffer uninitialized. Because the buffer is still converted to a Python object, callers can receive data that contains arbitrary process memory, leading to potential disclosure of confidential information. In addition, the uninitialized buffer may trigger a crash in the Python interpreter, causing a denial‑of‑service condition.

Affected software is the unmaintained Bitdefender pybddisasm Python package. No specific version numbers are provided, and the package will no longer receive updates or fixes.

The CVSS score of 6.9 indicates moderate to high severity. There is no EPSS data, and the issue is not listed in the CISA KEV catalogue, suggesting that widespread exploitation has not been documented yet. Exploitation requires local execution by an application that calls nd_to_text with inputs that cause a failure, which is an application‑specific local attack vector inferred from the description. Because the package is abandoned, the only reliable mitigation is to stop using it or replace it with a maintained alternative.