NULL Pointer Dereference in mruby Prism Parser

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: MITRE

Description

A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0. An attacker can provide a specially crafted Ruby source file that triggers the parser to pass a NULL pointer to nonnull string handling functions, resulting in undefined behavior and application crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-79590

Affected Vendors & Products

Vendor	Product	Version / Range
mruby	mruby	4.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a NULL pointer dereference vulnerability in the Prism parser component of mruby version 4.0.0. An attacker can exploit it by providing a specially crafted Ruby source file that causes the parser to pass a NULL pointer to string handling functions, leading to undefined behavior and application crashes.

Impact Analysis

This vulnerability could allow an attacker to crash the mruby application by providing malicious input. This may lead to denial of service, disrupting normal operations if the application is used in a server or critical system.

Mitigation Strategies

Upgrade mruby to a version that patches the NULL pointer dereference vulnerability in the Prism parser component. Avoid processing untrusted Ruby source files until the update is applied.

Hi! I’m here to help you understand CVE-2026-79590. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70