CVE-2026-1979

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-1979
A flaw has been found in mruby up to 3.4.0. This affects the function mrb_vm_exec of the file src/vm.c of the component JMPNOT-to-JMPIF Optimization. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been published and may be used. This patch is called e50f15c1c6e131fa7934355eb02b8173b13df415. It is advisable to implement a patch to correct this issue.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 3.1 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://github.com/mruby/mruby/ Product
https://github.com/mruby/mruby/issues/6701 Exploit Issue Tracking
https://github.com/mruby/mruby/issues/6701#issue-3802609843 Exploit Issue Tracking
https://github.com/sysfce2/mruby/commit/e50f15c1c6e131fa7934355eb02b8173b13df415 Patch
https://vuldb.com/?ctiid.344501 Permissions Required VDB Entry
https://vuldb.com/?id.344501 Third Party Advisory VDB Entry
https://vuldb.com/?submit.743377 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:mruby:mruby:*:*:*:*:*:ruby:*:*
History

28 Feb 2026, 00:33

Type Values Removed Values Added
CPE cpe:2.3:a:mruby:mruby:*:*:*:*:*:ruby:*:*
Summary
  • (es) Se ha encontrado una vulnerabilidad en mruby hasta la versión 3.4.0. Esto afecta a la función mrb_vm_exec del archivo src/vm.c del componente Optimización JMPNOT-a-JMPIF. La ejecución de una manipulación puede conducir a un uso después de liberar. El ataque debe lanzarse localmente. El exploit ha sido publicado y puede ser utilizado. Este parche se llama e50f15c1c6e131fa7934355eb02b8173b13df415. Es aconsejable implementar un parche para corregir este problema.
First Time Mruby mruby
Mruby
References () https://github.com/mruby/mruby/ - () https://github.com/mruby/mruby/ - Product
References () https://github.com/mruby/mruby/issues/6701 - () https://github.com/mruby/mruby/issues/6701 - Exploit, Issue Tracking
References () https://github.com/mruby/mruby/issues/6701#issue-3802609843 - () https://github.com/mruby/mruby/issues/6701#issue-3802609843 - Exploit, Issue Tracking
References () https://github.com/sysfce2/mruby/commit/e50f15c1c6e131fa7934355eb02b8173b13df415 - () https://github.com/sysfce2/mruby/commit/e50f15c1c6e131fa7934355eb02b8173b13df415 - Patch
References () https://vuldb.com/?ctiid.344501 - () https://vuldb.com/?ctiid.344501 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.344501 - () https://vuldb.com/?id.344501 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.743377 - () https://vuldb.com/?submit.743377 - Third Party Advisory, VDB Entry

06 Feb 2026, 05:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-06 05:16

Updated : 2026-02-28 00:33

NVD link : CVE-2026-1979

Mitre link : CVE-2026-1979

CVE.ORG link : CVE-2026-1979

JSON object : View

Products Affected

mruby

  • mruby
CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-416

Use After Free