BaseFortify

Publication date: 2025-11-07

Last updated on: 2026-04-29

Assigner: VulDB

Description

A weakness has been identified in mruby 3.4.0. This vulnerability affects the function ary_fill_exec of the file mrbgems/mruby-array-ext/src/array.c. Executing a manipulation of the argument start/length can lead to out-of-bounds write. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. This patch is called 93619f06dd378db6766666b30c08978311c7ec94. It is best practice to apply a patch to resolve this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-07

Last Modified

2026-04-29

Generated

2026-07-06

AI Q&A

2025-11-07

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12875

Affected Vendors & Products

Vendor	Product	Version / Range
mruby	mruby	3.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in mruby version 3.4.0, specifically in the function ary_fill_exec within the file mrbgems/mruby-array-ext/src/array.c. It involves improper handling of the start and length arguments, which can lead to an out-of-bounds write. The vulnerability requires local access to exploit and has a public exploit available. Applying the provided patch is recommended to fix the issue.

Impact Analysis

Exploitation of this vulnerability can lead to out-of-bounds memory writes, potentially causing data corruption, application crashes, or escalation of privileges on the affected system. Since the attack requires local access, an attacker with local user privileges could manipulate the system's behavior or compromise its integrity.

Mitigation Strategies

The best immediate step to mitigate this vulnerability is to apply the patch identified as 93619f06dd378db6766666b30c08978311c7ec94 to the affected mruby 3.4.0 version. Since the exploit requires local access, limiting local user permissions and access can also help reduce risk until the patch is applied.

Hi! I’m here to help you understand CVE-2025-12875. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70