CVE-2026-38976: NULL Pointer Dereference in mrubyc op_super()

Technical summary

The vulnerability stems from a missing runtime guard in the `op_super()` function within src/vm.c. When the mrubyc virtual machine encounters a OP_SUPER opcode, it does not verify that execution is occurring within a valid method context before dereferencing the super object pointer. If `super` is invoked at the top level—outside any method definition—the pointer remains NULL, and the subsequent dereference triggers a NULL pointer exception. This violates the CWE-476 classification for improper null pointer handling. The flaw is present in all versions through 3.4.1.

Business impact

Applications built with mrubyc 3.4.1 or earlier become vulnerable to denial of service attacks. An attacker can craft malicious input or bytecode that invokes top-level `super`, crashing the mrubyc runtime and halting application functionality. For embedded systems, IoT devices, or server applications relying on mrubyc for scripting or computation, this translates to unexpected downtime and potential cascading failures in dependent services. The impact is localized to availability; data confidentiality and integrity are not compromised.

Affected systems

mrubyc versions through 3.4.1 are affected. mrubyc is a lightweight Ruby interpreter designed for embedded and resource-constrained environments. Any application, firmware, or device that embeds mrubyc as a runtime engine is at risk if it processes untrusted Ruby code or bytecode. This includes IoT platforms, embedded scripting engines, and edge computing deployments that rely on mrubyc for dynamic code execution.

Exploitability

Exploitation is straightforward and requires no authentication, user interaction, or special privileges. An attacker with network connectivity to an application running vulnerable mrubyc can trigger the crash by submitting code or data that causes the interpreter to execute `super` outside a method definition. The low attack complexity means exploitation does not require deep system knowledge or specialized tools—basic fuzzing or code injection techniques may suffice. The CVSS 3.1 score of 7.5 (HIGH) reflects network accessibility, lack of privilege barriers, and guaranteed availability impact.

Remediation

Upgrade mrubyc to a patched version that includes a runtime guard ensuring `super` is only executed within a valid method context. Contact the mrubyc project maintainers or check the official repository for patch releases addressing this NULL pointer dereference. Until patching is possible, implement input validation and code review processes to prevent untrusted Ruby code from reaching the mrubyc interpreter.

Patch guidance

Verify the latest mrubyc release from the official project repository for a version post-3.4.1 that includes the fix for CVE-2026-38976. Apply patches systematically to all embedded or deployed instances. Test patched versions in a staging environment to ensure compatibility with existing Ruby code before production rollout. Document the patch version applied for audit and compliance records.

Detection guidance

Monitor mrubyc-based applications for unexpected crashes or service interruptions, particularly if they process Ruby code from external sources. Enable verbose logging at the mrubyc runtime level to capture stack traces indicating NULL pointer dereferences in op_super(). Network-based detection is limited; focus detection efforts on application behavior anomalies such as repeated process termination or restart loops. If feasible, implement static analysis on Ruby code before execution to identify suspicious or malformed super invocations.

Why prioritize this

This vulnerability warrants rapid remediation due to its HIGH severity, network-exploitable nature, and direct impact on service availability. Organizations running mrubyc in production should prioritize patching within days rather than weeks. The low attack complexity and absence of exploitation barriers elevate urgency, especially for customer-facing or critical infrastructure applications.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects: network accessibility (AV:N), no special attack prerequisites beyond sending crafted input (AC:L), no privilege or user interaction required (PR:N, UI:N), isolated availability impact (S:U, A:H), and no compromise of confidentiality or integrity (C:N, I:N). This positioning as HIGH—rather than CRITICAL—acknowledges that the impact is confined to denial of service; no data breach or system compromise occurs.

Frequently asked questions