CVE-2026-86547

MEDIUM 6.2

mrubyc through 4.0.0 NULL Pointer Dereference via OP_ENTER

CVSS Score

6.2

EPSS Score

0.0%

EPSS Percentile

0th

mrubyc through 4.0.0 contains a null pointer dereference vulnerability in the op_enter() handler in src/vm.c when processing untrusted bytecode. Attackers can craft malicious .mrb bytecode files with OP_ENTER instructions at the top level to crash the embedding application and cause denial of service.

CWE	CWE-476
Vendor	mrubyc
Product	mrubyc
Published	Sep 9, 2026
Last Updated	Sep 9, 2026

Stay Ahead of the Next One

Get instant alerts for mrubyc mrubyc

Be the first to know when new medium vulnerabilities affecting mrubyc mrubyc are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

mrubyc / mrubyc

2.0 ≤ 4.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/mrubyc/mrubyc/blob/release4.0.0/src/vm.c#L1537 github.com: https://github.com/mrubyc/mrubyc/blob/4261cf5e5ae5579e3110dab98a04b91c7d919429/src/vm.c#L1534 vulncheck.com: https://www.vulncheck.com/advisories/mrubyc-through-4.0.0-null-pointer-dereference-via-op-enter

Credits

Harsh Raj Singhania