CVE-2026-79590: Null Pointer Dereference
A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0. An attacker can provide a specially crafted Ruby source file that triggers the parser to pass a NULL pointer to nonnull string handling functions, resulting in undefined behavior and application crash.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using mruby 4.0.0 and invoking the Prism parser on Ruby source supplied by an attacker are exposed to a crash. The provided information identifies an application crash outcome, not code execution or data exposure.
What does an attacker need to exploit it?
An attacker needs to provide a specially crafted Ruby source file that is parsed by the affected Prism parser component. The malformed input causes a NULL pointer to reach string handling functions that require a non-NULL value.
How can I determine whether my application is affected?
Verify whether the application uses mruby 4.0.0 and parses attacker-controlled Ruby source through Prism. Affected processing may terminate or crash when handling specially crafted source input.