CVE-2018-10191

In versions of mruby up to and including 1.4.0, an integer overflow exists in src/vm.c::mrb_vm_exec() when handling OP_GETUPVAR in the presence of deep scope nesting, resulting in a use-after-free. An attacker that can cause Ruby code to be run can use this to possibly execute arbitrary code.

Database specific

{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "9.0"
                },
                {
                    "last_affected":  "9.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "debian:debian_linux"
        }
    ]
}

References

Affected packages

Git / github.com/mruby/mruby

Affected ranges

Type

GIT

Repo

https://github.com/mruby/mruby

Events

Introduced

Last Affected

58fb6f421ad9824caae5a2cabb849d48647b90ec

Fixed

1905091634a6a2925c911484434448e568330626

Database specific

Show details

{
    "cpe":  "cpe:2.3:a:mruby:mruby:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "1.4.0"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.0.0

1.1.0

1.2.0

1.4.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-10191.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "318179098320671580796334812011546468836",
                "31385894504806590158479134728976733374",
                "291488986920338441806228910834754532837",
                "234188554461621141776788455322527686487",
                "12890778145267399150668197333810861362",
                "46198236631767394421020263073167925398",
                "315187527932322571882289740280446195103",
                "295169726589021630819681535583790457470"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2018-10191-4f906dc6",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/mruby/mruby/commit/1905091634a6a2925c911484434448e568330626",
        "target":  {
            "file":  "src/vm.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "105486956670678688502489234273124890437",
            "length":  34172
        },
        "id":  "CVE-2018-10191-9de90541",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/mruby/mruby/commit/1905091634a6a2925c911484434448e568330626",
        "target":  {
            "file":  "src/vm.c",
            "function":  "mrb_vm_exec"
        }
    }
]

vanir_signatures_modified

"2026-07-08T14:13:44Z"