CVE-2026-38976 Details
Description
mrubyc through 3.4.1 was found to contain a NULL pointer dereference in src/vm.c in op_super() / OP_SUPER due to a missing runtime guard for top-level super.
A NULL pointer dereference vulnerability has been identified in mrubyc versions through 3.4.1. The issue arises in the 'op_super' function within 'src/vm.c', where a missing runtime guard for top-level 'super' leads to a crash. When 'super' is called at the top level, the virtual machine (VM) frame may not have valid metadata, causing the interpreter to crash instead of raising an appropriate Ruby exception. This vulnerability can be exploited by executing crafted .mrb bytecode that invokes 'super' in an invalid context, potentially disrupting the host application or terminating the interpreter.
Users can update to mrubyc version 3.4.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 6, 2026CISA-ADP
Assessed Jul 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mrubyc/mrubyc/issues/276 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/hayat01sh1da/mrubyc/commit/c4aa2a06bfdd13a0f1ae5165c5760a2530314a42 | [email protected] | Source CodeVendor |
| https://github.com/mrubyc/mrubyc | [email protected] | Vendor |
| https://github.com/mrubyc/mrubyc/issues/276 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| mrubyc | <= 3.4.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 6, 2026 | New CVE Received | [email protected] |