Executive brief
mruby is a lightweight Ruby interpreter embedded in other applications and systems. A flaw in its Prism parser component can be triggered by processing specially crafted Ruby source code, causing the application to crash or exhibit undefined behavior. This could lead to denial of service in any system using mruby for script execution or source code parsing.
Technical details
A NULL pointer dereference vulnerability (CWE-476) exists in the Prism parser component of mruby 4.0.0, where NULL pointers are passed to nonnull-attributed C functions: memcpy() at prism.c:2852 and memcmp() at pm_constant_pool.c:251. The root cause is that mruby's memory allocator returns NULL for zero-sized allocations, while the Prism parser (ported from a different Ruby implementation) expects malloc-like semantics that return a non-NULL pointer even for zero-byte allocations. An attacker can provide a specially crafted Ruby source file (as small as 35 bytes) that triggers empty token buffers, causing NULL pointers to be passed directly to these functions, resulting in undefined behavior visible as crashes under UBSan-instrumented builds or potential memory corruption in optimized builds. The vulnerability is triggered through the mrb_load_string() parsing function and has no authentication requirements. A fix involving a custom allocator wrapper that handles zero-sized allocations was identified and implemented.
Affected products
- mruby mruby 4.0.0
Timeline
- 2026-08-09: disclosed: Vulnerability reported on GitHub issue #7032
- 2026-09-10: advisory: CVE-2026-79590 published to NVD