Executive brief
mrubyc is a lightweight Ruby virtual machine designed for embedded systems and microcontrollers. A null pointer dereference vulnerability allows an attacker to crash applications using mrubyc by providing malicious bytecode files, causing service denial and potential system instability.
Technical details
A null pointer dereference vulnerability exists in the op_enter() handler within src/vm.c when processing OP_ENTER instructions in untrusted bytecode. Attackers can craft malicious .mrb bytecode files that place OP_ENTER instructions at the top level (outside of function/method definitions) to trigger the null dereference, crashing the embedding application. The vulnerability is triggered when bytecode is loaded and executed; no authentication or special privileges are required. An attacker can achieve denial of service by causing the application to crash, but code execution is not directly possible from this vulnerability alone.
Affected products
- mrubyc mrubyc through 4.0.0
Timeline
- 2026-09-09: disclosed