CVE-2026-38976
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In mrubyc up to version 3.4.1, a NULL pointer dereference was found in the op_super() function in src/vm.c due to a missing runtime guard for top-level super calls.
Risk Assessment
An attacker could exploit this vulnerability to cause application crashes (denial of service) by invoking the super method in an invalid context.
Recommendation
Update mrubyc to version 3.4.2 or later, which includes a fix for the NULL pointer dereference vulnerability.
Other vulnerabilities in mrubyc
See all- CVE-2026-86547Medium
mrubyc through 4.0.0 contains a null pointer dereference vulnerability in the op_enter() handler in src/vm.c when processing untrusted bytecode. Attackers can craft malicious .mrb files with OP_ENTER instructions at the top level to crash the embedding application and cause denial of service.
- CVE-2026-38973Medium
An out-of-bounds read was found in mrubyc up to release 3.4.1 during builtin missing-method lookup in mrbc_find_method().
Original NVD description (English source)
mrubyc through 3.4.1 was found to contain a NULL pointer dereference in src/vm.c in op_super() / OP_SUPER due to a missing runtime guard for top-level super.