CVE-2026-86547

mrubyc through 4.0.0 contains a null pointer dereference vulnerability in the op_enter() handler in src/vm.c when processing untrusted bytecode. Attackers can craft malicious .mrb bytecode files with OP_ENTER instructions at the top level to crash the embedding application and cause denial of service.

  • Published Sep 9, 2026
  • CVSS 6.9 medium
  • 0.2% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-86547 at the National Vulnerability Database