CVE-2026-86547
MediumCVSS 6.2Summary
mrubyc through 4.0.0 contains a null pointer dereference vulnerability in the op_enter() handler in src/vm.c when processing untrusted bytecode. Attackers can craft malicious .mrb files with OP_ENTER instructions at the top level to crash the embedding application and cause denial of service.
Risk Assessment
The risk includes application crashes, which could lead to service disruptions.
Recommendation
Update mrubyc to a version newer than 4.0.0 if a patch is available. Additionally, avoid processing untrusted bytecode and validate inputs.
Other vulnerabilities in mrubyc
See all- CVE-2026-38976High
In mrubyc up to version 3.4.1, a NULL pointer dereference was found in the op_super() function in src/vm.c due to a missing runtime guard for top-level super calls.
- CVE-2026-38973Medium
An out-of-bounds read was found in mrubyc up to release 3.4.1 during builtin missing-method lookup in mrbc_find_method().
Original NVD description (English source)
mrubyc through 4.0.0 contains a null pointer dereference vulnerability in the op_enter() handler in src/vm.c when processing untrusted bytecode. Attackers can craft malicious .mrb bytecode files with OP_ENTER instructions at the top level to crash the embedding application and cause denial of service.