CVE-2026-79590 Details
Description
A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0. An attacker can provide a specially crafted Ruby source file that triggers the parser to pass a NULL pointer to nonnull string handling functions, resulting in undefined behavior and application crash.
A NULL pointer dereference vulnerability has been identified in the Prism parser of mruby version 4.0.0. This vulnerability allows an attacker to craft a Ruby source file that causes the parser to pass a NULL pointer to string handling functions that require a non-null argument. This mismanagement leads to undefined behavior, potentially causing the application to crash.
The vulnerability has been addressed in a commit that modifies the Prism parser to use a custom allocator that correctly handles zero-size allocations by returning a non-null pointer. Users should update to the latest version of mruby to apply this fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 10, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mruby/mruby/issues/7032 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/mruby/mruby/issues/7032 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/takumin/mruby/commit/c6866eed4ad5640b552ba79d16063e7ec70a0ac9 | [email protected] | Source Code |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| mruby | 4.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 10, 2026 | New CVE Received | [email protected] |