CVE-2026-38976: Null Pointer Dereference
Published Jul 6, 2026
·Updated
mrubyc through 3.4.1 was found to contain a NULL pointer dereference in src/vm.c in opsuper() / OPSUPER due to a missing runtime guard for top-level super.
Affected Software
1 affected component
mruby>0<=3.4.1
Event History
Jul 6, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·10:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-38976?
CVE-2026-38976 has a high severity rating of 7.5 based on the CVSS v3.1 scoring system.
2
What are the risks associated with CVE-2026-38976?
CVE-2026-38976 carries a risk rating of 43, indicating significant potential impact due to a NULL pointer dereference.
3
How do I fix CVE-2026-38976?
To resolve CVE-2026-38976, users should upgrade to the latest version of mruby that addresses this NULL pointer dereference vulnerability.
4
Which versions of mruby are affected by CVE-2026-38976?
CVE-2026-38976 affects mruby versions up to and including 3.4.1.
5
What is the cause of CVE-2026-38976?
CVE-2026-38976 is caused by a NULL pointer dereference in the op_super() function due to a missing runtime guard for top-level super.