Quick answers
- Is CVE-2026-79590 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-79590 being exploited in the wild.
- How severe is CVE-2026-79590?
- Medium severity, with a CVSS score of 6.5, published 10 September 2026.
- Which products and versions are affected?
- Mruby 4.0.0.
- Is there a fix for CVE-2026-79590?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-79590 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-79590?
- Check whether you run Mruby at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A NULL pointer dereference vulnerability (CWE-476) exists in the Prism parser component of mruby 4.0.0, where NULL pointers are passed to nonnull-attributed C functions: memcpy() at prism.c:2852 and memcmp() at pm_constant_pool.c:251. The root cause is that mruby's memory allocator returns NULL for zero-sized allocations, while the Prism parser (ported from a different Ruby implementation) expects malloc-like semantics that return a non-NULL pointer even for zero-byte allocations. An attacker can provide a specially crafted Ruby source file (as small as 35 bytes) that triggers empty token buffers, causing NULL pointers to be passed directly to these functions, resulting in undefined behavior visible as crashes under UBSan-instrumented builds or potential memory corruption in optimized builds. The vulnerability is triggered through the mrb_load_string() parsing function and has no authentication requirements. A fix involving a custom allocator wrapper that handles zero-sized allocations was identified and implemented.
Affected products
- mruby mruby 4.0.0
Timeline
- 2026-08-09: disclosed: Vulnerability reported on GitHub issue #7032
- 2026-09-10: advisory: CVE-2026-79590 published to NVD