CVE-2026-86547

    Dashboard / Vulnerabilities / CVE-2026-86547

    CVE-2026-86547

    Published: 9 Sept 2026Last Modified: 12 Sept 2026

    Summary: mrubyc through 4.0.0 NULL Pointer Dereference via OP_ENTER

    Details: mrubyc through 4.0.0 contains a null pointer dereference vulnerability in the op_enter() handler in src/vm.c when processing untrusted bytecode. Attackers can craft malicious .mrb bytecode files with OP_ENTER instructions at the top level to crash the embedding application and cause denial of service.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86547.json, https://nvd.nist.gov/vuln/detail/CVE-2026-86547, https://www.vulncheck.com/advisories/mrubyc-through-4.0.0-null-pointer-dereference-via-op-enter, https://github.com/mrubyc/mrubyc, https://github.com/mrubyc/mrubyc/blob/4261cf5e5ae5579e3110dab98a04b91c7d919429/src/vm.c#L1534, https://github.com/mrubyc/mrubyc/blob/release4.0.0/src/vm.c#L1537

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 4f904e0dea407e3cc47c29cb4bf717eecb2921c1
    Fixed -434bccd609f2a3e90d6bb95c458621898bc6a508

    Affected versions

    release3.4.1
    release3.4

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-86547 | CVE-DB