CVE-2025-12875: mruby array.c ary_fill_exec out-of-bounds write
A weakness has been identified in mruby 3.4.0. This vulnerability affects the function aryfillexec of the file mrbgems/mruby-array-ext/src/array.c. Executing a manipulation of the argument start/length can lead to out-of-bounds write. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. This patch is called 93619f06dd378db6766666b30c08978311c7ec94. It is best practice to apply a patch to resolve this issue.
Other sources
mruby array.c aryfillexec out-of-bounds write
— Microsoft
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12875?
CVE-2025-12875 has been classified as a medium severity vulnerability.
How do I fix CVE-2025-12875?
To fix CVE-2025-12875, you should update mruby to version 3.4.1 or later.
What type of attack does CVE-2025-12875 facilitate?
CVE-2025-12875 facilitates an out-of-bounds write attack that can be exploited locally.
Which version of mruby is affected by CVE-2025-12875?
CVE-2025-12875 affects mruby version 3.4.0.
What specific function is vulnerable in CVE-2025-12875?
The vulnerability in CVE-2025-12875 is located in the ary_fill_exec function in the mrbgems/mruby-array-ext/src/array.c file.