CVE-2026-79590
UnknownSummary
A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0. An attacker can provide a specially crafted Ruby source file that triggers the parser to pass a NULL pointer to string handling functions, resulting in undefined behavior and application crash.
Risk Assessment
An attacker can crash an application using mruby, causing a denial of service (DoS). In environments processing untrusted Ruby files, this may disrupt service availability.
Recommendation
Update mruby to a version containing the fix or avoid processing untrusted Ruby source files. Consider validating input before passing it to the parser.
Other vulnerabilities in mruby
See all- CVE-2017-9527High
The mark_context_stack function in gc.c in mruby through 1.2.0 allows attackers to cause a denial of service (heap-based use-after-free and application crash) or possibly have unspecified other impact via a crafted .rb file.
- CVE-2022-4996Medium
A flaw has been found in mruby 3.1.0. The function udiv in bigint.c is affected. Executing a manipulation can lead to floating point comparison with incorrect operator. The attack can be launched remotely, and the exploit has been published.
Original NVD description (English source)
A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0. An attacker can provide a specially crafted Ruby source file that triggers the parser to pass a NULL pointer to nonnull string handling functions, resulting in undefined behavior and application crash.