Vulnerability · Published Sep 9, 2026 · Assigned by VulnCheck

CVE-2026-86547mrubyc through 4.0.0 NULL Pointer Dereference via OP_ENTER

Medium 6.2

In plain English

A medium-severity null pointer dereference in mrubyc from mrubyc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)6.2Medium

Exploit odds (30 days)0.2%top 92.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

mrubyc through 4.0.0 contains a null pointer dereference vulnerability in the op_enter() handler in src/vm.c when processing untrusted bytecode. Attackers can craft malicious .mrb bytecode files with OP_ENTER instructions at the top level to crash the embedding application and cause denial of service.

Affected products (as reported)

Vendor	Product	Versions
mrubyc	mrubyc	2.0 – through 4.0.0

Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/mrubyc/mrubyc/blob/release4.0.0/src/vm.c#L1537 technical-description
https://github.com/mrubyc/mrubyc/blob/4261cf5e5ae5579e3110dab98a04b91c7d919429/src/vm.c#L1534 technical-description
VulnCheck Advisory: mrubyc through 4.0.0 NULL Pointer Dereference via OP_ENTER third-party-advisory