CVE-2026-79590

Deferred Deferred - Pending Action

NULL Pointer Dereference in mruby Prism Parser

Publication date: 2026-09-10

Last updated on: 2026-09-22

Assigner: MITRE

Description

A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0. An attacker can provide a specially crafted Ruby source file that triggers the parser to pass a NULL pointer to nonnull string handling functions, resulting in undefined behavior and application crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-22

Generated

2026-10-01

AI Q&A

2026-09-11

EPSS Evaluated

2026-09-29

NVD

CVE-2026-79590

EUVD

EUVD-2026-75871

Affected Vendors & Products

Vendor	Product	Version / Range
mruby	mruby	4.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This is a NULL pointer dereference vulnerability in the Prism parser component of mruby version 4.0.0. An attacker can exploit it by providing a specially crafted Ruby source file that causes the parser to pass a NULL pointer to string handling functions, leading to undefined behavior and application crashes.

Detection Guidance

This vulnerability is specific to mruby 4.0.0 and involves a NULL pointer dereference in the Prism parser. Detection requires checking if mruby 4.0.0 is installed and monitoring for crashes when parsing Ruby source files. No direct network detection commands are applicable.

Impact Analysis

This vulnerability could allow an attacker to crash the mruby application by providing malicious input. This may lead to denial of service, disrupting normal operations if the application is used in a server or critical system.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other standards as it is a technical issue causing application crashes without evidence of data exposure or privacy violations.

Mitigation Strategies

Upgrade mruby to a version that patches the NULL pointer dereference vulnerability in the Prism parser component. Avoid processing untrusted Ruby source files until the update is applied.

Hi! I’m here to help you understand CVE-2026-79590. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70