CVE-2026-38976

HighCVSS 7.5

Published: 06/07/2026(UTC)Updated: 07/07/2026(UTC)Translated: 08/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

In mrubyc up to version 3.4.1, a NULL pointer dereference was found in the op_super() function in src/vm.c due to a missing runtime guard for top-level super calls.

Risk Assessment

An attacker could exploit this vulnerability to cause application crashes (denial of service) by invoking the super method in an invalid context.

Recommendation

Update mrubyc to version 3.4.2 or later, which includes a fix for the NULL pointer dereference vulnerability.

Original NVD description (English source)

mrubyc through 3.4.1 was found to contain a NULL pointer dereference in src/vm.c in op_super() / OP_SUPER due to a missing runtime guard for top-level super.