mrubyc vulnerabilities

mrubyc through 4.0.0 contains a null pointer dereference vulnerability in the op_enter() handler in src/vm.c when processing untrusted bytecode. Attackers can craft malicious .mrb files with OP_ENTER instructions at the top level to crash the embedding application and cause denial of service.

In mrubyc up to version 3.4.1, a NULL pointer dereference was found in the op_super() function in src/vm.c due to a missing runtime guard for top-level super calls.

An out-of-bounds read was found in mrubyc up to release 3.4.1 during builtin missing-method lookup in mrbc_find_method().

mrubyc up to 3.4 has a vulnerability in the mrbc_raw_realloc function in src/alloc.c. Manipulation of the ptr argument leads to a null pointer dereference. The attack requires local access, and the patch is identified by commit 009111904807b8567262036bf45297c3da8f1c87.