Listen to this Post
How the CVE works:
The vulnerability CVE-2025-13397 exists in mrubyc up to version 3.4. It specifically targets the mrbc_raw_realloc function in src/alloc.c. This function handles dynamic memory reallocation. When the argument ptr is manipulated to become a null pointer, the function dereferences it without validation. Null pointer dereference occurs when code accesses memory at address zero, which is invalid. Attackers with local access can craft inputs to pass null as ptr. The function likely assumes ptr is always valid, leading to direct dereference. This causes a segmentation fault or crash. The issue stems from missing null checks before pointer operations. In memory management, realloc should treat null pointers as malloc, but here it fails. Exploitation involves triggering mrbc_raw_realloc with null ptr via controlled data. This leads to denial of service by crashing the application. The vulnerability is a classic C programming error. The patch adds proper null pointer validation. Commit hash 009111904807b8567262036bf45297c3da8f1c87 fixes this. It ensures ptr is checked before use, preventing dereference. This highlights the importance of input sanitization in low-level functions.
Platform: mrubyc
Version: up to 3.4
Vulnerability: Null Pointer Dereference
Severity: MEDIUM
date: 11/19/2025
Prediction: Patch expected 12/01/2025
What Undercode Say:
Analytics:
Bash commands:
git clone mrubyc repository
cd mrubyc
git checkout v3.4
grep mrbc_raw_realloc alloc.c
git show patch commit
Codes:
// src/alloc.c snippet
mrbc_raw_realloc function code
Pointer dereference without check
How Exploit:
Local null pointer manipulation
Protection from this CVE:
Apply patch update
Impact:
Denial service crash
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
