CVE-2026-86547

Deferred Deferred - Pending Action

Null Pointer Dereference in mrubyc

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: VulnCheck

Description

mrubyc through 4.0.0 contains a null pointer dereference vulnerability in the op_enter() handler in src/vm.c when processing untrusted bytecode. Attackers can craft malicious .mrb bytecode files with OP_ENTER instructions at the top level to crash the embedding application and cause denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86547

EUVD

EUVD-2026-74787

Affected Vendors & Products

Vendor	Product	Version / Range
mrubyc	mrubyc	to 4.0.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability is a null pointer dereference in mrubyc through version 4.0.0. It occurs in the op_enter() handler in src/vm.c when processing untrusted bytecode. Attackers can craft malicious .mrb files with OP_ENTER instructions at the top level to crash the embedding application and cause a denial of service.

Detection Guidance

To detect this vulnerability, inspect systems running mrubyc versions up to 4.0.0 for crashes when processing .mrb bytecode files. Check logs for application failures during OP_ENTER instruction handling. No specific commands are provided in the resources.

Impact Analysis

This vulnerability can cause the application using mrubyc to crash, leading to a denial of service. If the application is part of a critical system, this could disrupt services and require manual intervention to restore functionality.

Compliance Impact

This vulnerability causes denial of service by crashing applications processing untrusted .mrb bytecode. While not directly violating GDPR or HIPAA, such crashes could disrupt systems handling personal health or user data, potentially leading to compliance failures if availability is compromised.

Mitigation Strategies

Immediately upgrade mrubyc to a version beyond 4.0.0. If upgrading is not possible, restrict execution of untrusted .mrb bytecode files. Monitor applications for crashes or denial of service conditions related to OP_ENTER instructions.

Hi! I’m here to help you understand CVE-2026-86547. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70