CVE-2025-7207
LOW EPSS 11.7%
Published Jul 9, 202511mo ago · Modified Jun 17, 20262w ago
1.9 CVSS 4.0
Published Jul 9, 2025 11mo ago
Last Modified Jun 17, 2026 2w ago
Description
A vulnerability, which was classified as problematic, was found in mruby up to 3.4.0-rc2. Affected is the function scope_new of the file mrbgems/mruby-compiler/core/codegen.c of the component nregs Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The name of the patch is 1fdd96104180cc0fb5d3cb086b05ab6458911bb9. It is recommended to apply a patch to fix this issue.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
11.7% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available
Weaknesses 3
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer Memory Safety
CWE-122
CWE-787 Out-of-bounds Write Memory Safety
Affected Products 3
References 7
- github.com https://github.com/mruby/mruby/commit/1fdd96104180cc0fb5d3cb086b05ab6458911bb9
- github.com https://github.com/mruby/mruby/issues/6509
- github.com https://github.com/mruby/mruby/issues/6509#event-17145516649
- github.com https://github.com/user-attachments/files/19619499/mruby_crash.txt
- vuldb.com https://vuldb.com/?ctiid.315156
- vuldb.com https://vuldb.com/?id.315156
- vuldb.com https://vuldb.com/?submit.607683
Remediation
- github.com https://github.com/mruby/mruby/commit/1fdd96104180cc0fb5d3cb086b05ab6458911bb9