In versions of mruby up to and including 1.4.0, a use-after-free vulnerability exists in src/io.c::File#initilializecopy(). An attacker that can cause Ruby code to be run can possibly use this to execute arbitrary code.

In mruby 2.1.0, there is a use-after-free in hashvaluesat in mrbgems/mruby-hash-ext/src/hash-ext.c.

In mruby 2.1.0, there is a use-after-free in hashslice in mrbgems/mruby-hash-ext/src/hash-ext.c.

In mruby 2.1.0, there is a stack-based buffer overflow in mrbstrlentodbl in string.c.

mruby is vulnerable to Heap-based Buffer Overflow

Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.

Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.

mruby through 2.1.2-rc has a heap-based buffer overflow in the mrbyieldwithclass function in vm.c because of incorrect VM stack handling. It can be triggered via the stackcopy function.

The initcopy function in kernel.c in mruby 1.4.1 makes initializecopy calls for TTICLASS objects, which allows attackers to cause a denial of service (mrbhashkeys uninitialized pointer and application crash) or possibly have unspecified other impact.

In versions of mruby up to and including 1.4.0, an integer overflow exists in src/vm.c::mrbvmexec() when handling OPGETUPVAR in the presence of deep scope nesting, resulting in a use-after-free. An attacker that can cause Ruby code to be run can use this to possibly execute arbitrary code.

Use-After-Free in strescape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.

heap-buffer-overflow in mrbvmexec in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.

Out-of-bounds Read in mrbgetargs in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.

mruby is vulnerable to NULL Pointer Dereference

Out-of-bounds Read in Homebrew mruby prior to 3.2.

Out-of-bounds Read in Homebrew mruby prior to 3.2.

Out-of-bounds Read in GitHub repository mruby/mruby prior to 3.2.

use after free in mrbvmexec in GitHub repository mruby/mruby prior to 3.2.

Use of Out-of-range Pointer Offset in Homebrew mruby prior to 3.2.

User after free in mrbvmexec in GitHub repository mruby/mruby prior to 3.2.

A weakness has been identified in mruby 3.4.0. This vulnerability affects the function aryfillexec of the file mrbgems/mruby-array-ext/src/array.c. Executing a manipulation of the argument start/length can lead to out-of-bounds write. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. This patch is called 93619f06dd378db6766666b30c08978311c7ec94. It is best practice to apply a patch to resolve this issue.

The markcontextstack function in gc.c in mruby through 1.2.0 allows attackers to cause a denial of service (heap-based use-after-free and application crash) or possibly have unspecified other impact via a crafted .rb file.

mruby 2.1.2 has a double free in mrbdefaultallocf (called from mrbfree and objfree).

NULL Pointer Dereference in Homebrew mruby prior to 3.2.

Out-of-bounds Read in mrbobjiskindof in in GitHub repository mruby/mruby prior to 3.2. # Impact: Possible arbitrary code execution if being exploited.

Use After Free in GitHub repository mruby/mruby prior to 3.2.

The CHECK macro in mrbgems/mruby-sprintf/src/sprintf.c in mruby 1.4.1 contains a signed integer overflow, possibly leading to out-of-bounds memory access because the mrbstrresize function in string.c does not check for a negative length.

mruby is vulnerable to NULL Pointer Dereference

An untrusted pointer dereference in mrbvmexec() of mruby v3.0.0 can lead to a segmentation fault or application crash.

mruby is vulnerable to NULL Pointer Dereference