CVE-2026-1979
📋 TL;DR
A use-after-free vulnerability in mruby up to version 3.4.0 allows local attackers to execute arbitrary code or cause denial of service. This affects the JMPNOT-to-JMPIF optimization in the virtual machine component. Systems running vulnerable mruby versions are at risk.
💻 Affected Systems
- mruby
📦 What is this software?
Mruby by Mruby
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise, arbitrary code execution, or persistent backdoor installation.
Likely Case
Local denial of service, application crashes, or limited privilege escalation within the mruby context.
If Mitigated
Minimal impact if proper sandboxing and privilege separation are implemented, with only local user access required.
🎯 Exploit Status
Exploit requires local access and manipulation of mruby bytecode. The vulnerability is in the JMPNOT-to-JMPIF optimization logic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit e50f15c1c6e131fa7934355eb02b8173b13df415
Vendor Advisory: https://github.com/mruby/mruby/issues/6701
Restart Required: Yes
Instructions:
1. Update mruby to a version containing commit e50f15c1c6e131fa7934355eb02b8173b13df415
2. Rebuild any applications using mruby
3. Restart affected services
🔧 Temporary Workarounds
Disable JMP optimization
allModify mruby build configuration to disable JMPNOT-to-JMPIF optimization
Modify build_config.rb to remove -DMRB_OPT_JMP_OPTIMIZATION flag
🧯 If You Can't Patch
- Implement strict privilege separation and sandboxing for mruby processes
- Restrict local user access to systems running vulnerable mruby versions
🔍 How to Verify
Check if Vulnerable:
Check mruby version with 'mruby --version' or examine source code for commit e50f15c1c6e131fa7934355eb02b8173b13df415Check Version:
mruby --versionVerify Fix Applied:
Verify mruby version is newer than 3.4.0 or contains the fix commit📡 Detection & Monitoring
Log Indicators:
- Segmentation faults in mruby processes
- Unexpected process termination
- Memory access violation errors
Network Indicators:
- None - local exploitation only
SIEM Query:
Process:Name="mruby" AND EventID=1000 OR EventID=1001 (Windows) OR Process:Name="mruby" AND Signal=11 (Linux)🔗 References
- https://github.com/mruby/mruby/
- https://github.com/mruby/mruby/issues/6701
- https://github.com/mruby/mruby/issues/6701#issue-3802609843
- https://github.com/sysfce2/mruby/commit/e50f15c1c6e131fa7934355eb02b8173b13df415
- https://vuldb.com/?ctiid.344501
- https://vuldb.com/?id.344501
- https://vuldb.com/?submit.743377
