A NULL pointer dereference exists in the Prism parser component of mruby 4.0.0. An attacker can supply a specially crafted Ruby source file that forces the parser to pass a null pointer to functions that expect a non‑null string. This results in undefined behavior and leads the host application to crash. The immediate security impact is a denial of service, but the undefined behavior could also enable other instability or memory corruption effects depending on the context.

mruby 4.0.0. The vulnerability affects any installation of mruby that uses the Prism parser to process Ruby source files. Users running mruby 4.0.0 on any platform are potentially impacted.

The CVSS score is not reported, but the vulnerability requires an attacker to provide malicious Ruby code to the vulnerable parser – a scenario likely restricted to environments that execute user‑supplied Ruby. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Nonetheless, because a null pointer dereference can lead to a crash and possible memory corruption, the risk level is considered moderate and service disruption could be achieved with simple crafted input.