CVE-2026-86547: mrubyc through 4.0.0 NULL Pointer Dereference via OP_ENTER
mrubyc through 4.0.0 contains a null pointer dereference vulnerability in the openter() handler in src/vm.c when processing untrusted bytecode. Attackers can craft malicious .mrb bytecode files with OPENTER instructions at the top level to crash the embedding application and cause denial of service.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Embedding applications that process untrusted .mrb bytecode are exposed. The impact is a crash of the embedding application, resulting in denial of service.
What must an attacker provide to trigger the crash?
An attacker needs to cause the application to process a crafted .mrb bytecode file containing OP_ENTER instructions at the top level. No privileges or user interaction are required, but the attack requires local access according to the supplied vector.
How can I determine whether my application is affected?
Check whether it uses mrubyc through version 4.0.0 and accepts or processes .mrb bytecode from untrusted sources. Applications that do not process attacker-controlled bytecode are not described as exposed by the available information.