CVE-2025-12875
BaseFortify
Publication date: 2025-11-07
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mruby | mruby | 3.4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in mruby version 3.4.0, specifically in the function ary_fill_exec within the file mrbgems/mruby-array-ext/src/array.c. It involves improper handling of the start and length arguments, which can lead to an out-of-bounds write. The vulnerability requires local access to exploit and has a public exploit available. Applying the provided patch is recommended to fix the issue.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to out-of-bounds memory writes, potentially causing data corruption, application crashes, or escalation of privileges on the affected system. Since the attack requires local access, an attacker with local user privileges could manipulate the system's behavior or compromise its integrity.
What immediate steps should I take to mitigate this vulnerability?
The best immediate step to mitigate this vulnerability is to apply the patch identified as 93619f06dd378db6766666b30c08978311c7ec94 to the affected mruby 3.4.0 version. Since the exploit requires local access, limiting local user permissions and access can also help reduce risk until the patch is applied.