VulnerabilityAnalyzed
CVE-2026-1979
Executing a manipulation can lead to use after free.
LOW 1.9EPSS 0.16%
Does this matter?
Lower severity and a low EPSS score (0.16%). Track it; it rarely justifies an emergency change on its own.
Description
A flaw has been found in mruby up to 3.4.0. This affects the function mrb_vm_exec of the file src/vm.c of the component JMPNOT-to-JMPIF Optimization. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been published and may be used. This patch is called e50f15c1c6e131fa7934355eb02b8173b13df415. It is advisable to implement a patch to correct this issue.
- CVSS 4.0
- 1.9 LOWCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.16% probability · 5th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119, CWE-416
- Affected
- mruby/mruby
- Source
- cna@vuldb.com
References
- https://github.com/mruby/mruby/Product
- https://github.com/mruby/mruby/issues/6701Exploit, Issue Tracking
- https://github.com/mruby/mruby/issues/6701#issue-3802609843Exploit, Issue Tracking
- https://github.com/sysfce2/mruby/commit/e50f15c1c6e131fa7934355eb02b8173b13df415Patch
- https://vuldb.com/?ctiid.344501Permissions Required, VDB Entry
- https://vuldb.com/?id.344501Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.743377Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.