Out-of-Bounds Read in mrubyc

Executive Summary

This vulnerability is an out-of-bounds read found in mrubyc through release 3.4.1. It occurs in the builtin missing-method lookup function inside mrbc_find_method().

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is an out-of-bounds read in the builtin missing-method lookup function mrbc_find_method() within the mruby/c interpreter. Detection typically involves verifying the version of mruby/c in use and checking for the presence of the vulnerable code.

Since this is a code-level vulnerability in mruby/c, detection on a network or system would primarily involve identifying if the vulnerable version of mruby/c (through release 3.4.1) is installed or running.

You can check the version of mruby/c installed by running commands such as:

• `mruby -v` or `mruby --version` (if available) to display the version of mruby/c.
• If you have access to the source or binary, you can inspect the version or build date to determine if it is before the fixed release (4.0.0 released June 12, 2026).

For more in-depth detection, you might need to audit the source code or binaries for the presence of the vulnerable function mrbc_find_method() and whether the fix (commit f83a8b67ca1c7c62ac0dd548a363d79f767c4e30) has been applied.

No specific network detection commands or signatures are provided in the available resources.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability involves an out-of-bounds read in the builtin missing-method lookup inside mrbc_find_method() in mrubyc through release 3.4.1.

An out-of-bounds read can potentially lead to application crashes or unexpected behavior, which may be exploited to cause denial of service or information disclosure depending on the context of use.

Useful 0 Not Useful 0

Compliance Impact

There is no information provided in the available context or resources regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update mruby/c (mrubyc) to version 4.0.0 or later, as this release includes the fix for the out-of-bounds read in the mrbc_find_method() function.

The fix involves a code change that prevents out-of-bounds access by adjusting the binary search bounds in src/class.c. Applying this update will prevent exploitation of the vulnerability.

Useful 0 Not Useful 0