Mruby
by Mruby
Source repositories
CVEs (43)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-9527 | Hig | 0.51 | 7.8 | 0.01 | Jun 11, 2017 | The mark_context_stack function in gc.c in mruby through 1.2.0 allows attackers to cause a denial of service (heap-based use-after-free and application crash) or possibly have unspecified other impact via a crafted .rb file. | ||
| CVE-2018-14337 | Hig | 0.49 | 7.5 | 0.01 | Jul 17, 2018 | The CHECK macro in mrbgems/mruby-sprintf/src/sprintf.c in mruby 1.4.1 contains a signed integer overflow, possibly leading to out-of-bounds memory access because the mrb_str_resize function in string.c does not check for a negative length. | ||
| CVE-2026-1979 | Med | 0.27 | 5.3 | 0.00 | Feb 6, 2026 | A flaw has been found in mruby up to 3.4.0. This affects the function mrb_vm_exec of the file src/vm.c of the component JMPNOT-to-JMPIF Optimization. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been published and… | ||
| CVE-2025-13120 | Med | 0.27 | 5.3 | 0.00 | Nov 13, 2025 | A vulnerability has been found in mruby up to 3.4.0. This vulnerability affects the function sort_cmp of the file src/array.c. Such manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The… | ||
| CVE-2025-12875 | Med | 0.27 | 5.3 | 0.00 | Nov 7, 2025 | A weakness has been identified in mruby 3.4.0. This vulnerability affects the function ary_fill_exec of the file mrbgems/mruby-array-ext/src/array.c. Executing a manipulation of the argument start/length can lead to out-of-bounds write. The attack needs to be launched locally.… | ||
| CVE-2025-7207 | Low | 0.21 | 3.3 | 0.00 | Jul 9, 2025 | A vulnerability, which was classified as problematic, was found in mruby up to 3.4.0-rc2. Affected is the function scope_new of the file mrbgems/mruby-compiler/core/codegen.c of the component nregs Handler. The manipulation leads to heap-based buffer overflow. An attack has to… | ||
| CVE-2025-13397 | 0.00 | — | 0.00 | Nov 19, 2025 | A security vulnerability has been detected in mrubyc up to 3.4. This impacts the function mrbc_raw_realloc of the file src/alloc.c. Such manipulation of the argument ptr leads to null pointer dereference. An attack has to be approached locally. The name of the patch is… | |||
| CVE-2021-46023 | 0.00 | — | 0.01 | Feb 14, 2023 | An Untrusted Pointer Dereference was discovered in function mrb_vm_exec in mruby before 3.1.0-rc. The vulnerability causes a segmentation fault and application crash. | |||
| CVE-2022-1934 | 0.00 | — | 0.00 | May 31, 2022 | Use After Free in GitHub repository mruby/mruby prior to 3.2. | |||
| CVE-2022-1427 | 0.00 | — | 0.00 | Apr 22, 2022 | Out-of-bounds Read in mrb_obj_is_kind_of in in GitHub repository mruby/mruby prior to 3.2. # Impact: Possible arbitrary code execution if being exploited. | |||
| CVE-2022-1286 | 0.00 | — | 0.01 | Apr 10, 2022 | heap-buffer-overflow in mrb_vm_exec in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited. | |||
| CVE-2022-1276 | 0.00 | — | 0.01 | Apr 10, 2022 | Out-of-bounds Read in mrb_get_args in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited. | |||
| CVE-2022-1212 | 0.00 | — | 0.02 | Apr 5, 2022 | Use-After-Free in str_escape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited. | |||
| CVE-2022-1201 | 0.00 | — | 0.00 | Apr 2, 2022 | NULL Pointer Dereference in mrb_vm_exec with super in GitHub repository mruby/mruby prior to 3.2. This vulnerability is capable of making the mruby interpreter crash, thus affecting the availability of the system. | |||
| CVE-2022-1106 | 0.00 | — | 0.01 | Mar 27, 2022 | use after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2. | |||
| CVE-2022-1071 | 0.00 | — | 0.01 | Mar 26, 2022 | User after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2. | |||
| CVE-2022-0890 | 0.00 | — | 0.01 | Mar 10, 2022 | NULL Pointer Dereference in GitHub repository mruby/mruby prior to 3.2. | |||
| CVE-2022-0717 | 0.00 | — | 0.01 | Feb 23, 2022 | Out-of-bounds Read in GitHub repository mruby/mruby prior to 3.2. | |||
| CVE-2022-0632 | 0.00 | — | 0.01 | Feb 19, 2022 | NULL Pointer Dereference in Homebrew mruby prior to 3.2. | |||
| CVE-2022-0630 | 0.00 | — | 0.01 | Feb 19, 2022 | Out-of-bounds Read in Homebrew mruby prior to 3.2. |
- risk 0.51cvss 7.8epss 0.01
The mark_context_stack function in gc.c in mruby through 1.2.0 allows attackers to cause a denial of service (heap-based use-after-free and application crash) or possibly have unspecified other impact via a crafted .rb file.
- risk 0.49cvss 7.5epss 0.01
The CHECK macro in mrbgems/mruby-sprintf/src/sprintf.c in mruby 1.4.1 contains a signed integer overflow, possibly leading to out-of-bounds memory access because the mrb_str_resize function in string.c does not check for a negative length.
- risk 0.27cvss 5.3epss 0.00
A flaw has been found in mruby up to 3.4.0. This affects the function mrb_vm_exec of the file src/vm.c of the component JMPNOT-to-JMPIF Optimization. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been published and…
- risk 0.27cvss 5.3epss 0.00
A vulnerability has been found in mruby up to 3.4.0. This vulnerability affects the function sort_cmp of the file src/array.c. Such manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The…
- risk 0.27cvss 5.3epss 0.00
A weakness has been identified in mruby 3.4.0. This vulnerability affects the function ary_fill_exec of the file mrbgems/mruby-array-ext/src/array.c. Executing a manipulation of the argument start/length can lead to out-of-bounds write. The attack needs to be launched locally.…
- risk 0.21cvss 3.3epss 0.00
A vulnerability, which was classified as problematic, was found in mruby up to 3.4.0-rc2. Affected is the function scope_new of the file mrbgems/mruby-compiler/core/codegen.c of the component nregs Handler. The manipulation leads to heap-based buffer overflow. An attack has to…
- CVE-2025-13397Nov 19, 2025risk 0.00cvss —epss 0.00
A security vulnerability has been detected in mrubyc up to 3.4. This impacts the function mrbc_raw_realloc of the file src/alloc.c. Such manipulation of the argument ptr leads to null pointer dereference. An attack has to be approached locally. The name of the patch is…
- CVE-2021-46023Feb 14, 2023risk 0.00cvss —epss 0.01
An Untrusted Pointer Dereference was discovered in function mrb_vm_exec in mruby before 3.1.0-rc. The vulnerability causes a segmentation fault and application crash.
- CVE-2022-1934May 31, 2022risk 0.00cvss —epss 0.00
Use After Free in GitHub repository mruby/mruby prior to 3.2.
- CVE-2022-1427Apr 22, 2022risk 0.00cvss —epss 0.00
Out-of-bounds Read in mrb_obj_is_kind_of in in GitHub repository mruby/mruby prior to 3.2. # Impact: Possible arbitrary code execution if being exploited.
- CVE-2022-1286Apr 10, 2022risk 0.00cvss —epss 0.01
heap-buffer-overflow in mrb_vm_exec in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
- CVE-2022-1276Apr 10, 2022risk 0.00cvss —epss 0.01
Out-of-bounds Read in mrb_get_args in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
- CVE-2022-1212Apr 5, 2022risk 0.00cvss —epss 0.02
Use-After-Free in str_escape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
- CVE-2022-1201Apr 2, 2022risk 0.00cvss —epss 0.00
NULL Pointer Dereference in mrb_vm_exec with super in GitHub repository mruby/mruby prior to 3.2. This vulnerability is capable of making the mruby interpreter crash, thus affecting the availability of the system.
- CVE-2022-1106Mar 27, 2022risk 0.00cvss —epss 0.01
use after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.
- CVE-2022-1071Mar 26, 2022risk 0.00cvss —epss 0.01
User after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.
- CVE-2022-0890Mar 10, 2022risk 0.00cvss —epss 0.01
NULL Pointer Dereference in GitHub repository mruby/mruby prior to 3.2.
- CVE-2022-0717Feb 23, 2022risk 0.00cvss —epss 0.01
Out-of-bounds Read in GitHub repository mruby/mruby prior to 3.2.
- CVE-2022-0632Feb 19, 2022risk 0.00cvss —epss 0.01
NULL Pointer Dereference in Homebrew mruby prior to 3.2.
- CVE-2022-0630Feb 19, 2022risk 0.00cvss —epss 0.01
Out-of-bounds Read in Homebrew mruby prior to 3.2.
Page 1 of 3