mruby array.c sort_cmp use after free

published 2025-11-13 11 mo ago modified 2026-10-19 21 d ago also EUVD-2025-175315

cvss: 5.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 4%
public exploits: 0; none known

A vulnerability has been found in mruby up to 3.4.0. This vulnerability affects the function sort_cmp of the file src/array.c. Such manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The name of the patch is eb398971bfb43c38db3e04528b68ac9a7ce509bc. It is advisable to implement a patch to correct this issue.

Patch / fix

distros 1 links 2

mruby Debian 14 4.0.0-1

debian advisories DEBIAN-CVE-2025-13120

github.com/mruby/mruby@eb39897 commit
github.com/makesoftwaresafe/mruby#263 pull request

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 11 mo ago (2025-11-13)

Exploit prediction

0.16% chance of exploitation in the next 30 days, higher than 4% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/mruby/mruby/issues/6649#issue-3534393003 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	4.8	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CNA	3.1	5.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CNA	3.0	5.3	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CNA	2.0	4.3	AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
CNA	4.0	1.9	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	5.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA	2.0	4.3	AV:L/AC:L/Au:S/C:P/I:P/A:P

Affected products

n/a mruby

Classification

Weakness

CWE-416 Use After Free
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

github.com /makesoftwaresafe/mruby/pull/263
issue-tracking
github.com /mruby/mruby/commit/eb398971bfb43c38db3e04528b68ac9a7ce509bc
patch
github.com /mruby/mruby/issues/6649#issue-3534393003
exploit, issue-tracking, vendor-advisory
github.com /mruby/mruby/issues/6649
issue-tracking, vendor-advisory
vuldb.com /?id.332325
vdb-entry, technical-description, third-party-advisory
vuldb.com /?ctiid.332325
signature, permissions-required, vdb-entry
vuldb.com /?submit.683435
third-party-advisory, vdb-entry
github.com /mruby/mruby/
product

Sources

CVE List CVE-2025-13120
NVD CVE-2025-13120

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary