NULL Pointer Dereference in mrubyc

Executive Summary

This vulnerability is a NULL pointer dereference found in mrubyc versions through 3.4.1. It occurs in the source file src/vm.c within the function op_super() / OP_SUPER. The issue arises because there is a missing runtime guard for the top-level super, which can lead to the program attempting to access a NULL pointer.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by observing crashes or denial-of-service conditions in the mrubyc interpreter when executing Ruby bytecode files that use the `super` keyword at the top level.

Specifically, if you have access to the environment running mrubyc, you can test for the vulnerability by running a crafted .mrb bytecode file containing a top-level `super` call and monitoring if the interpreter crashes.

There are no explicit commands provided in the resources, but a practical approach is to execute a test script or bytecode that uses `super` outside of a method context and check for crashes or error messages.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update mrubyc to a version that includes the fix for CVE-2026-38976.

The fix adds a runtime guard in the `op_super` function to check if the call information is NULL before proceeding, preventing null pointer dereference crashes.

If updating is not immediately possible, avoid executing Ruby bytecode that uses the `super` keyword outside of method contexts, as this triggers the vulnerability.

Useful 0 Not Useful 0

Impact Analysis

A NULL pointer dereference can cause the affected program to crash or behave unexpectedly. This can lead to denial of service or instability in applications using mrubyc through version 3.4.1.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not include any details about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0