The vulnerability is a null pointer dereference in the op_enter() handler of mrubyc’s virtual machine, triggered when the interpreter processes untrusted bytecode containing OP_ENTER instructions at the top level. This flaw causes the embedding application to crash, resulting in a denial of service condition for users of any component that loads user‑supplied .mrb files. The issue is a classic example of uncontrolled dereference of a NULL pointer (CWE‑476).

The flaw affects the mrubyc interpreter up to and including version 4.0.0. Any systems that embed or run mrubyc and accept externally supplied bytecode are vulnerable. The product name is mrubyc, and the affected releases are all versions through 4.0.0.

The CVSS base score of 6.9 indicates moderate severity, and no EPSS score is available, so the current exploit probability is unknown. The vulnerability is not in the CISA KEV list. Exploitation requires access to the embedding application’s bytecode loader, meaning that an attacker can trigger the crash by delivering a malicious .mrb file. The impact is limited to an application crash and denial of service; no remote code execution, data loss, or privilege escalation is reported. The attack vector is inferred to be the delivery of crafted bytecode, either locally or over a network interface that the application accepts.