CVE-2025-12875
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-07

Last updated on: 2026-04-29

Assigner: VulDB

Description
A weakness has been identified in mruby 3.4.0. This vulnerability affects the function ary_fill_exec of the file mrbgems/mruby-array-ext/src/array.c. Executing a manipulation of the argument start/length can lead to out-of-bounds write. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. This patch is called 93619f06dd378db6766666b30c08978311c7ec94. It is best practice to apply a patch to resolve this issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-07
Last Modified
2026-04-29
Generated
2026-06-16
AI Q&A
2025-11-07
EPSS Evaluated
2026-06-15
NVD
CVE-2025-12875
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
mruby mruby 3.4.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in mruby version 3.4.0, specifically in the function ary_fill_exec within the file mrbgems/mruby-array-ext/src/array.c. It involves improper handling of the start and length arguments, which can lead to an out-of-bounds write. The vulnerability requires local access to exploit and has a public exploit available. Applying the provided patch is recommended to fix the issue.

Impact Analysis

Exploitation of this vulnerability can lead to out-of-bounds memory writes, potentially causing data corruption, application crashes, or escalation of privileges on the affected system. Since the attack requires local access, an attacker with local user privileges could manipulate the system's behavior or compromise its integrity.

Mitigation Strategies

The best immediate step to mitigate this vulnerability is to apply the patch identified as 93619f06dd378db6766666b30c08978311c7ec94 to the affected mruby 3.4.0 version. Since the exploit requires local access, limiting local user permissions and access can also help reduce risk until the patch is applied.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-12875. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart