mrubyc up to release 3.4.1 contains an out‑of‑bounds read in the builtin missing‑method lookup performed by the function mrbc_find_method(). This flaw allows an attacker to read memory beyond the intended bounds, potentially revealing sensitive data located adjacent to the buffer. The vulnerability is a classic out‑of‑bounds read (CWE‑125), typically triggered by malformed input or crafted method calls that provoke the missing‑method lookup.

The affected product is the mrubyc interpreter, specifically all releases through and including version 3.4.1. Users running these releases should verify whether their environments include the patched commit identified by f83a8b67ca1c7c62ac0dd548a363d79f767c4e30 or later.

The CVSS score of 4.4 indicates moderate severity, while the EPSS score is below 1 %, reflecting a very low current probability of exploitation. Because the vulnerability is not listed in the CISA KEV catalog, there is no evidence of active, widespread attacks. The plausible attack vector is local, requiring execution of code that triggers the missing‑method lookup within mrubyc; no network exposure is described in the advisory. Consequently, the overall risk is moderate, driven primarily by the potential for data disclosure rather than by remote code execution or denial of service.