NULL Pointer Dereference in mrubyc

Publication date: 2026-07-06

Last updated on: 2026-07-06

Assigner: MITRE

Description

mrubyc through 3.4.1 was found to contain a NULL pointer dereference in src/vm.c in op_super() / OP_SUPER due to a missing runtime guard for top-level super.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-06

Last Modified

2026-07-06

Generated

2026-07-07

AI Q&A

2026-07-07

EPSS Evaluated

N/A

NVD

CVE-2026-38976

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a NULL pointer dereference found in mrubyc versions through 3.4.1. It occurs in the source file src/vm.c within the function op_super() / OP_SUPER. The issue arises because there is a missing runtime guard for the top-level super, which can lead to the program attempting to access a NULL pointer.

Impact Analysis

A NULL pointer dereference can cause the affected program to crash or behave unexpectedly. This can lead to denial of service or instability in applications using mrubyc through version 3.4.1.

Hi! I’m here to help you understand CVE-2026-38976. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70