What is the CVSS score of CVE-2026-38976?

CVE-2026-38976 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of mruby/c (mrubyc) are affected by CVE-2026-38976?

mruby/c lightweight Ruby interpreter (versions ≤3.4.1) contains a denial-of-service vulnerability triggered by executing 'super' calls outside method context, causing VM crashes and service…

How to fix or mitigate CVE-2026-38976?

Within 24 hours: Audit production systems to identify where mruby/c 3.4.1 or earlier is deployed and whether user-supplied or untrusted scripts are executed on it. Within 7 days: Implement input validation to reject or sanitize 'super' keyword usage in scripts before mruby/c execution, and deploy automated process restart mechanisms to recover from crashes. Within 30 days: Request patch timeline from mruby/c project; if no patch timeline emerges, evaluate migrating to maintained Ruby implementations (CRuby, JRuby) or restricting mruby/c to fully trusted, internally-vetted scripts only.

mruby/c (mrubyc) CVE-2026-38976

EUVD-2026-41977 HIGH

NULL Pointer Dereference (CWE-476)

2026-07-06 mitre

GHSA-ff2c-rpvx-jp6m

Denial Of Service Null Pointer Dereference N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.2 MEDIUM

Trigger needs an attacker-supplied script executed by the VM, which is local input rather than a network service, so AV:L; no auth modeled (PR:N) and only the process crashes (A:H, C/I:N).

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 17:24 vuln.today

CVSS changed

Jul 07, 2026 - 17:22 NVD

7.5 (HIGH)

CVE Published

Jul 06, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

mrubyc through 3.4.1 was found to contain a NULL pointer dereference in src/vm.c in op_super() / OP_SUPER due to a missing runtime guard for top-level super.

AnalysisAI

Denial of service in the mruby/c lightweight Ruby VM (all releases through 3.4.1) arises from a NULL pointer dereference in op_super()/OP_SUPER within src/vm.c, where a runtime guard for a top-level 'super' call is missing. When the interpreter executes a script that invokes 'super' outside of any method context, the VM dereferences a NULL pointer and crashes. There is no public exploit identified at time of analysis, and the low EPSS score (0.15%, 5th percentile) reflects limited exploitation interest; impact is confined to availability (CWE-476).

Technical ContextAI

mruby/c is a compact reimplementation of the mruby Ruby VM aimed at microcontrollers and resource-constrained embedded devices, executing pre-compiled Ruby bytecode. The defect is a classic CWE-476 NULL pointer dereference in the OP_SUPER bytecode handler (op_super() in src/vm.c). 'super' delegates to a parent method's implementation and normally relies on the presence of an enclosing method/class frame; when 'super' is invoked at the top level there is no target method structure, and the handler proceeds to dereference a pointer that is NULL because the required runtime guard is absent, terminating the interpreter. The CPE data is uninformative (cpe:2.3:a:n/a:n/a:*:...), so affected-product identity comes from the description and the mrubyc GitHub repository rather than a structured NVD CPE.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - a candidate fix commit is published at https://github.com/hayat01sh1da/mrubyc/commit/c4aa2a06bfdd13a0f1ae5165c5760a2530314a42 (a contributor fork), which adds the missing runtime guard so top-level 'super' is rejected instead of dereferencing NULL; track upstream integration and release via issue https://github.com/mrubyc/mrubyc/issues/276. Until an official tagged release is available, the primary compensating control is to ensure the VM only executes trusted, statically-reviewed bytecode and to reject or sandbox any externally-supplied scripts (trade-off: eliminates any feature that runs user-submitted Ruby); alternatively, pre-validate/lint incoming scripts to reject top-level 'super' before execution (trade-off: adds a parsing step and may miss obfuscated variants). Apply watchdog/auto-restart supervision on embedded devices so a crash does not cause prolonged outage (trade-off: masks the fault rather than fixing it).