CVE-2026-38973
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
An out-of-bounds read was found in mrubyc up to release 3.4.1 during builtin missing-method lookup in mrbc_find_method().
Risk Assessment
This vulnerability may lead to disclosure of sensitive memory data or unexpected application behavior in systems using mrubyc.
Recommendation
Update mrubyc to a version newer than 3.4.1 as soon as a patch is released by the vendor.
Other vulnerabilities in mrubyc
See all- CVE-2026-86547Medium
mrubyc through 4.0.0 contains a null pointer dereference vulnerability in the op_enter() handler in src/vm.c when processing untrusted bytecode. Attackers can craft malicious .mrb files with OP_ENTER instructions at the top level to crash the embedding application and cause denial of service.
- CVE-2026-38976High
In mrubyc up to version 3.4.1, a NULL pointer dereference was found in the op_super() function in src/vm.c due to a missing runtime guard for top-level super calls.
- CVE-2025-13397Low
mrubyc up to 3.4 has a vulnerability in the mrbc_raw_realloc function in src/alloc.c. Manipulation of the ptr argument leads to a null pointer dereference. The attack requires local access, and the patch is identified by commit 009111904807b8567262036bf45297c3da8f1c87.
Original NVD description (English source)
mrubyc through release3.4.1 was found to contain an out-of-bounds read in builtin missing-method lookup inside mrbc_find_method().
Vulnerability data from NVD (NIST) · CISA KEV · EPSS