Listen to this Post
The vulnerability CVE-2025-12875 resides in the `ary_fill_exec` function within mruby’s array extension (array.c). This function handles the `Arrayfill` method. When a user provides manipulated `start` and `length` arguments, the function’s bounds checking fails. Specifically, improper validation allows an attacker to specify a `start` index that is negative or beyond the array’s bounds, combined with a crafted `length` value. This incorrect calculation leads to a pointer being set to a memory location outside the intended array buffer. Subsequent write operations using this pointer then corrupt adjacent memory, causing an out-of-bounds write. The flaw requires local access to exploit and can potentially lead to arbitrary code execution or a denial-of-service by crashing the mruby interpreter.
Platform: mruby
Version: 3.4.0
Vulnerability: Out-of-bounds write
Severity: Medium
date: 2025-11-07
Prediction: 2025-11-10 Patched
What Undercode Say:
$ grep -n "ary_fill_exec" mrbgems/mruby-array-ext/src/array.c $ git show 93619f06dd378db6766666b30c08978311c7ec94 $ ruby -e "a = []; a.fill(0, -100, 50)"
How Exploit:
Local user executes malicious mruby script calling `Arrayfill` with manipulated negative start and large length arguments to trigger memory corruption.
Protection from this CVE
Apply upstream patch commit 93619f06dd. Update mruby to version >3.4.0. Sanitize all user inputs to array functions.
Impact:
Memory corruption, denial-of-service, potential arbitrary code execution within the interpreter context.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
