CVE-2025-12875

Katalog CVE

CVSS 7.8 · High EPSS 0,17%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada mruby. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

A weakness has been identified in mruby 3.4.0. This vulnerability affects the function ary_fill_exec of the file mrbgems/mruby-array-ext/src/array.c. Executing a manipulation of the argument start/length can lead to out-of-bounds write. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. This patch is called 93619f06dd378db6766666b30c08978311c7ec94. It is best practice to apply a patch to resolve this issue.

Rincian

Terbit di NVD

7 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 6,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/makesoftwaresafe/mruby/commit/93619f06dd378db6766666b30c08978311c7ec94 patch
• https://github.com/mruby/mruby/issues/6650#issuecomment-3430851605 patch
• https://vuldb.com/?id.331511 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.680879 advisory pihak ketiga · vdb entry
• https://github.com/mruby/mruby/
• https://github.com/mruby/mruby/issues/6650 issue tracking
• https://github.com/mruby/mruby/issues/6650#event-20443453808 issue tracking
• https://vuldb.com/?ctiid.331511 permissions required · vdb entry