CVE-2025-12875CWE-119CWE-787

CVE-2025-12875

Medium · published November 8, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
6.5
In the wild
Unconfirmed
What it is

A weakness has been identified in mruby 3.4.0. This vulnerability affects the function ary_fill_exec of the file mrbgems/mruby-array-ext/src/array.c. Executing a manipulation of the argument start/length can lead to out-of-bounds write. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. This patch is called 93619f06dd378db6766666b30c08978311c7ec94. It is best practice to apply a patch to resolve this issue.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00174 · 6.5th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-787 · Out-of-bounds Write
Published
2025-11-08T02:15Z
Affected products (1)
ProductVersionsFixed in
mruby/mrubyall versions—
References (10)
https://github.com/makesoftwaresafe/mruby/commit/93619f06dd378db6766666b30c08978311c7ec94 · [email protected]https://github.com/mruby/mruby/ · [email protected]https://github.com/mruby/mruby/issues/6650 · [email protected]https://github.com/mruby/mruby/issues/6650#event-20443453808 · [email protected]https://github.com/mruby/mruby/issues/6650#issuecomment-3430851605 · [email protected]https://vuldb.com/?ctiid.331511 · [email protected]https://vuldb.com/?id.331511 · [email protected]https://vuldb.com/?submit.680879 · [email protected]https://github.com/mruby/mruby/issues/6650 · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/mruby/mruby/issues/6650#issuecomment-3430851605 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 07 NOV 20:32Z
    mruby array.c ary_fill_exec out-of-bounds write
    cvelistv5