The vulnerability resides in the udiv function of mruby 3.1.0's bigint.c module, where a floating point comparison uses an incorrect operator. Manipulating input to that function can cause the comparison to evaluate incorrectly, allowing an attacker to influence the result of logical checks performed by mruby scripts. The affected function is part of the big integer arithmetic library, and an incorrect comparison can lead to improper control flow or erroneous decisions, potentially enabling unauthorized actions if the comparison guards security‑critical logic.

Affected vendor is mruby, specifically the mruby interpreter version 3.1.0. No patch version is listed in the provided data, but the exploit targets exactly this release and earlier distributions compiled from the same source. Other mruby releases are not mentioned as affected.

The CVSS score of 6.9 places the flaw in the medium severity range. EPSS is not available, and the flaw is not listed in the CISA KEV catalog yet, however a public exploit has been published, indicating the attack can be performed from a remote host. Attackers can trigger the vulnerability by sending crafted data to an mruby component, which will be processed by the faulty udiv routine. Without a patch, the risk remains active and may be employed in automated scanning or targeted attacks.