Description
A vulnerability has been found in mruby up to 3.4.0. This vulnerability affects the function sort_cmp of the file src/array.c. Such manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The name of the patch is eb398971bfb43c38db3e04528b68ac9a7ce509bc. It is advisable to implement a patch to correct this issue.
Affected products
mruby: mruby
References8
- github.com/mruby/mruby/issues/6649 Issue TrackingVendor Advisory
- github.com/mruby/mruby/issues/6649#issue-3534393003 Issue TrackingVendor Advisory
- github.com/mruby/mruby/commit/eb398971bfb43c38db3e04528b68ac9a7… Patch
- github.com/makesoftwaresafe/mruby/pull/263 Issue Tracking
- github.com/mruby/mruby/
- vuldb.com/?ctiid.332325 Permissions RequiredVDB Entry
- vuldb.com/?id.332325 Third Party AdvisoryVDB Entry
- vuldb.com/?submit.683435 Third Party AdvisoryVDB Entry
Metrics
- CVSS 3.1
-
5.5
MEDIUM
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 4.0
-
1.9
LOW
Score source: CNA
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 0% percentile: 5 · as of 11 November 2026
- CWE
- CWE-119CWE-416
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.