CVE-2025-12875

low-risk
Published 2025-11-07

A weakness has been identified in mruby 3.4.0. This vulnerability affects the function ary_fill_exec of the file mrbgems/mruby-array-ext/src/array.c. Executing a manipulation of the argument start/length can lead to out-of-bounds write. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. This patch is called 93619f06dd378db6766666b30c08978311c7ec94. It is best practice to apply a patch to resolve this issue.

Do I need to act?

-
0.01% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.3/10 Medium
LOCAL / LOW complexity

Affected Products (1)

Affected Vendors

Mruby

References (10)

Patch https://github.com/makesoftwaresafe/mruby/commit/93619f06dd378db6766666b30c08978...
https://github.com/mruby/mruby/
Issue Tracking https://github.com/mruby/mruby/issues/6650
Issue Tracking https://github.com/mruby/mruby/issues/6650#event-20443453808
Patch https://github.com/mruby/mruby/issues/6650#issuecomment-3430851605
Permissions Required https://vuldb.com/?ctiid.331511
Third Party Advisory https://vuldb.com/?id.331511
Third Party Advisory https://vuldb.com/?submit.680879
Issue Tracking https://github.com/mruby/mruby/issues/6650
Patch https://github.com/mruby/mruby/issues/6650#issuecomment-3430851605
23
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal