CVE-2026-38973
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
An out-of-bounds read was found in mrubyc up to release 3.4.1 during builtin missing-method lookup in mrbc_find_method().
Risk Assessment
This vulnerability may lead to disclosure of sensitive memory data or unexpected application behavior in systems using mrubyc.
Recommendation
Update mrubyc to a version newer than 3.4.1 as soon as a patch is released by the vendor.
Other vulnerabilities in mrubyc
See all- CVE-2026-86547Medium
mrubyc through 4.0.0 contains a null pointer dereference vulnerability in the op_enter() handler in src/vm.c when processing untrusted bytecode. Attackers can craft malicious .mrb files with OP_ENTER instructions at the top level to crash the embedding application and cause denial of service.
- CVE-2026-38976High
In mrubyc up to version 3.4.1, a NULL pointer dereference was found in the op_super() function in src/vm.c due to a missing runtime guard for top-level super calls.
Original NVD description (English source)
mrubyc through release3.4.1 was found to contain an out-of-bounds read in builtin missing-method lookup inside mrbc_find_method().