Log in Start free

Vulnerability · Published Feb 6, 2026 · Assigned by VulDB

CVE-2026-1979mruby JMPNOT-to-JMPIF Optimization vm.c mrb_vm_exec use after free

Medium 5.3

In plain English

A medium-severity use-after-free in mruby. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 92.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw has been found in mruby up to 3.4.0. This affects the function mrb_vm_exec of the file src/vm.c of the component JMPNOT-to-JMPIF Optimization. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been published and may be used. This patch is called e50f15c1c6e131fa7934355eb02b8173b13df415. It is advisable to implement a patch to correct this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12mrubyno fix listedDEBIAN-CVE-2026-1979
Debian:13mrubyno fix listedDEBIAN-CVE-2026-1979
Debian:14mruby4.0.0-1DEBIAN-CVE-2026-1979
Ubuntu:22.04:LTSmrubyno fix listedUBUNTU-CVE-2026-1979
Ubuntu:24.04:LTSmrubyno fix listedUBUNTU-CVE-2026-1979
Ubuntu:25.10mrubyno fix listedUBUNTU-CVE-2026-1979
Ubuntu:26.04:LTSmrubyno fix listedUBUNTU-CVE-2026-1979
Ubuntu:26.10mrubyno fix listedUBUNTU-CVE-2026-1979

Affected products (as reported)

VendorProductVersions
n/a mruby 3.03.13.23.33.4.0

Weakness: CWE-416, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References