Log in Start free

Vulnerability · Published Jul 9, 2025 · Assigned by VulDB

CVE-2025-7207mruby nregs codegen.c scope_new heap-based overflow

Low 3.3

In plain English

A low-severity heap buffer overflow in mruby. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.3%top 82.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability, which was classified as problematic, was found in mruby up to 3.4.0-rc2. Affected is the function scope_new of the file mrbgems/mruby-compiler/core/codegen.c of the component nregs Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The name of the patch is 1fdd96104180cc0fb5d3cb086b05ab6458911bb9. It is recommended to apply a patch to fix this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12mrubyno fix listedDEBIAN-CVE-2025-7207
Debian:13mrubyno fix listedDEBIAN-CVE-2025-7207
Debian:14mruby3.4.0-2DEBIAN-CVE-2025-7207
Ubuntu:22.04:LTSmrubyno fix listedUBUNTU-CVE-2025-7207
Ubuntu:24.04:LTSmrubyno fix listedUBUNTU-CVE-2025-7207
Ubuntu:25.10mrubyno fix listedUBUNTU-CVE-2025-7207
Ubuntu:26.04:LTSmrubyno fix listedUBUNTU-CVE-2025-7207
Ubuntu:26.10mrubyno fix listedUBUNTU-CVE-2025-7207

Affected products (as reported)

VendorProductVersions
n/a mruby 3.4.0-rc13.4.0-rc2

Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References