CVE-2026-1979

mruby JMPNOT-to-JMPIF Optimization vm.c mrb_vm_exec use after free

View on CVE.org
Published Feb 6, 2026 CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Description
A flaw has been found in mruby up to 3.4.0. This affects the function mrb_vm_exec of the file src/vm.c of the component JMPNOT-to-JMPIF Optimization. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been published and may be used. This patch is called e50f15c1c6e131fa7934355eb02b8173b13df415. It is advisable to implement a patch to correct this issue.

Analysis

AI-generated

Technical impact

The flaw is in the JMPNOT-to-JMPIF Optimization function mrb_vm_exec and allows a use‑after‑free condition when specific code manipulations are executed. Attacking code can corrupt memory after the freed resource is referenced, which may result in unintended behavior or compromise program integrity. The vulnerability is limited to local execution and does not expose remote code execution directly.

Affected Systems

mruby versions up to 3.4.0 are affected. The bug resides in the core vm.c component and has been publicly reported with a fix committed at e50f15c1c6e131fa7934355eb02b8173b13df415. Any installation of mruby 3.4.0 or earlier that has not applied this patch is vulnerable.

Risk and Exploitability

The CVSS score of 4.8 reflects a moderate risk. EPSS indicates a low exploitation probability (<1%). The vulnerability is not listed in the CISA KEV catalog. The exploit is local, requiring the attacker to run code on the host, and currently no remote exploitation vectors are documented. The published exploit demonstrates that a local attacker can trigger the use‑after‑free, potentially leading to memory corruption.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the patch identified by commit e50f15c1c6e131fa7934355eb02b8173b13df415 or upgrade to a later mruby release that includes this fix.
  • Recompile mruby with the advised patch to ensure the optimization function no longer dereferences freed memory.
  • Limit local access to untrusted code execution sites or run mruby in a sandboxed environment to minimize exposure from local attackers.

Generated by OpenCVE AI on April 18, 2026 at 13:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:2.3:a:mruby:mruby:*:*:*:*:*:ruby:*:*
Type Values Removed Values Added
CPEs cpe:2.3:a:mruby:mruby:*:*:*:*:*:*:*:*
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Mruby
Mruby mruby
Vendors & Products Mruby
Mruby mruby
Type Values Removed Values Added
Description A flaw has been found in mruby up to 3.4.0. This affects the function mrb_vm_exec of the file src/vm.c of the component JMPNOT-to-JMPIF Optimization. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been published and may be used. This patch is called e50f15c1c6e131fa7934355eb02b8173b13df415. It is advisable to implement a patch to correct this issue.
Title mruby JMPNOT-to-JMPIF Optimization vm.c mrb_vm_exec use after free
Weaknesses CWE-119
CWE-416
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-416

    Use After Free

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Feb 23, 2026, 9:21 AM
Reserved
Feb 5, 2026, 1:44 PM

View source JSON

Updated
Feb 6, 2026, 8:26 PM

JSON

Status
Analyzed
Published
Feb 6, 2026, 5:16 AM
Modified
Jun 17, 2026, 10:16 AM

View source JSON

No data.

Updated
Apr 18, 2026, 1:45 PM

JSON