CVE-2026-1979

A flaw has been found in mruby up to 3.4.0. This affects the function mrbvmexec of the file src/vm.c of the component JMPNOT-to-JMPIF Optimization. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been published and may be used. This patch is called e50f15c1c6e131fa7934355eb02b8173b13df415. It is advisable to implement a patch to correct this issue.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-119",
        "CWE-416"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1979.json"
}

References

Affected packages

Git / github.com/mruby/mruby

Affected ranges

Type

GIT

Repo

https://github.com/mruby/mruby

Events

Introduced

0f45836b5954accf508f333f932741b925214471

Last affected

a309524d0bc90eef077a24634db2495a6f68e318

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:mruby:mruby:*:*:*:*:*:ruby:*:*",
    "extracted_events": [
        {
            "introduced": "3.0"
        },
        {
            "last_affected": "3.0"
        },
        {
            "introduced": "3.1"
        },
        {
            "last_affected": "3.1"
        },
        {
            "introduced": "3.2"
        },
        {
            "last_affected": "3.2"
        },
        {
            "introduced": "3.3"
        },
        {
            "last_affected": "3.3"
        },
        {
            "introduced": "3.4.0"
        },
        {
            "last_affected": "3.4.0"
        },
        {
            "introduced": "0"
        }
    ]
}

Type

GIT

Repo

https://github.com/sysfce2/mruby

Events

Introduced

Fixed

e50f15c1c6e131fa7934355eb02b8173b13df415

Database specific

{
    "source": "REFERENCES"
}

Affected versions

1.*

1.0.0

1.1.0

1.2.0

3.*

3.0

3.0.0-preview

3.1

3.2

3.3

3.4.0

Database specific

vanir_signatures_modified

"2026-07-22T03:08:39Z"

vanir_signatures

[
    {
        "target": {
            "file": "mrbgems/mruby-compiler/core/codegen.c"
        },
        "digest": {
            "line_hashes": [
                "309700451298586127084147669564925157237",
                "206465718435458731545810550109385677489",
                "232266857713372375953676997730443733663",
                "120459724042526479545393141050980971602",
                "88368804593802825400990602459277649762"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2026-1979-19a22880",
        "source": "https://github.com/sysfce2/mruby/commit/e50f15c1c6e131fa7934355eb02b8173b13df415"
    },
    {
        "target": {
            "function": "codegen",
            "file": "mrbgems/mruby-compiler/core/codegen.c"
        },
        "digest": {
            "length": 9440.0,
            "function_hash": "60665796433931384598915782097009808259"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2026-1979-82aaa20e",
        "source": "https://github.com/sysfce2/mruby/commit/e50f15c1c6e131fa7934355eb02b8173b13df415"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1979.json"