Log in Start free

Vulnerability · Published Nov 13, 2025 · Assigned by VulDB

CVE-2025-13120mruby array.c sort_cmp use after free

Medium 5.3

In plain English

A medium-severity use-after-free in mruby. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 95.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in mruby up to 3.4.0. This vulnerability affects the function sort_cmp of the file src/array.c. Such manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The name of the patch is eb398971bfb43c38db3e04528b68ac9a7ce509bc. It is advisable to implement a patch to correct this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12mrubyno fix listedDEBIAN-CVE-2025-13120
Debian:13mrubyno fix listedDEBIAN-CVE-2025-13120
Debian:14mruby4.0.0-1DEBIAN-CVE-2025-13120
Ubuntu:22.04:LTSmrubyno fix listedUBUNTU-CVE-2025-13120
Ubuntu:24.04:LTSmrubyno fix listedUBUNTU-CVE-2025-13120
Ubuntu:25.10mrubyno fix listedUBUNTU-CVE-2025-13120
Ubuntu:26.04:LTSmrubyno fix listedUBUNTU-CVE-2025-13120
Ubuntu:26.10mrubyno fix listedUBUNTU-CVE-2025-13120

Affected products (as reported)

VendorProductVersions
n/a mruby 3.03.13.23.33.4.0

Weakness: CWE-416, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References