mrubyc, the lightweight Ruby interpreter used in embedded devices, contains an out‑of‑bounds read triggered during the builtin missing‑method lookup performed by mrbc_find_method(). The flaw can cause memory adjacent to the lookup buffer to be read, allowing an attacker to exfiltrate sensitive data stored there. The vulnerability is a classic out‑of‑bounds read (CWE‑125) and is not known to provide code execution or denial of service.

The issue affects all mrubyc releases up to and including 3.4.1. Any deployment running those releases is potentially vulnerable. No vendor names were supplied beyond 'mrubyc', and the affected versions are identified only by the release number.

The CVSS score of 4.4 indicates moderate severity. The EPSS score is reported as < 1 %, reflecting a very low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is local and requires crafted input that triggers the missing‑method lookup, so external network exposure is not specified as necessary. Overall risk remains moderate, driven by the potential for sensitive data disclosure rather than remote code execution.