CVE-2025-12875
mruby array.c ary_fill_exec out-of-bounds write
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
A weakness has been identified in mruby 3.4.0. This vulnerability affects the function ary_fill_exec of the file mrbgems/mruby-array-ext/src/array.c. Executing a manipulation of the argument start/length can lead to out-of-bounds write. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. This patch is called 93619f06dd378db6766666b30c08978311c7ec94. It is best practice to apply a patch to resolve this issue.
| CWE | CWE-787 CWE-119 |
| Vendor | n/a |
| Product | mruby |
| Published | Nov 7, 2025 |
| Last Updated | Feb 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for n/a mruby
Be the first to know when new medium vulnerabilities affecting n/a mruby are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
n/a / mruby
3.4.0
References
vuldb.com: https://vuldb.com/?id.331511 vuldb.com: https://vuldb.com/?ctiid.331511 vuldb.com: https://vuldb.com/?submit.680879 github.com: https://github.com/mruby/mruby/issues/6650 github.com: https://github.com/mruby/mruby/issues/6650#event-20443453808 github.com: https://github.com/mruby/mruby/issues/6650#issuecomment-3430851605 github.com: https://github.com/makesoftwaresafe/mruby/commit/93619f06dd378db6766666b30c08978311c7ec94 github.com: https://github.com/mruby/mruby/
Credits
🔍 tjbecker (VulDB User)