Mruby is a lightweight, embeddable Ruby interpreter designed for resource-constrained environments and integration into larger applications, and despite a narrow product scope, sits prominently in the vulnerability landscape due to its widespread adoption across embedded systems, IoT devices, and third-party software. Vulnerabilities affecting the vendor skew strongly toward critical-severity outcomes, reflecting the memory-safety challenges inherent to a C-based interpreter implementation that processes untrusted script input. The exposure recurs consistently through memory-management weakness classes including NULL-pointer dereferences, use-after-free conditions, buffer overflows, and out-of-bounds access—flaws that can compromise the integrity of host applications or enable arbitrary code execution from within the interpreter sandbox. Defenders should monitor mruby updates closely and prioritize patching in internet-facing or privilege-sensitive deployments, particularly where the interpreter processes untrusted input; current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Mruby over time
Signals from CVEs in this vendor scope (42 CVEs).
42 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-1286CRITICAL heap-buffer-overflow in mrb_vm_exec in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited. | Apr 10, 2022 | 9.8 | 31 | NO | NO |
CVE-2022-0570CRITICAL Heap-based Buffer Overflow in Homebrew mruby prior to 3.2. | Feb 14, 2022 | 9.8 | 31 | NO | NO |
CVE-2018-11743CRITICAL The init_copy function in kernel.c in mruby 1.4.1 makes initialize_copy calls for TT_ICLASS objects, which allows attackers to cause a denial of service (mrb_hash_keys uninitialize | Jun 5, 2018 | 9.8 | 31 | NO | NO |
CVE-2018-10199CRITICAL In versions of mruby up to and including 1.4.0, a use-after-free vulnerability exists in src/io.c::File#initilialize_copy(). An attacker that can cause Ruby code to be run can poss | Apr 18, 2018 | 9.8 | 31 | NO | NO |
CVE-2018-10191CRITICAL In versions of mruby up to and including 1.4.0, an integer overflow exists in src/vm.c::mrb_vm_exec() when handling OP_GETUPVAR in the presence of deep scope nesting, resulting in | Apr 17, 2018 | 9.8 | 31 | NO | NO |
CVE-2022-1276CRITICAL Out-of-bounds Read in mrb_get_args in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited. | Apr 10, 2022 | 9.8 | 30 | NO | NO |
CVE-2020-15866CRITICAL mruby through 2.1.2-rc has a heap-based buffer overflow in the mrb_yield_with_class function in vm.c because of incorrect VM stack handling. It can be triggered via the stack_copy | Jul 21, 2020 | 9.8 | 30 | NO | NO |
CVE-2022-0631CRITICAL Heap-based Buffer Overflow in Homebrew mruby prior to 3.2. | Feb 18, 2022 | 9.8 | 29 | NO | NO |
CVE-2022-0525CRITICAL Out-of-bounds Read in Homebrew mruby prior to 3.2. | Feb 9, 2022 | 9.1 | 28 | NO | NO |
CVE-2022-1212CRITICAL Use-After-Free in str_escape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited. | Apr 5, 2022 | 9.8 | 27 | NO | NO |
Signals from CVEs in this vendor scope (42 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Mruby.
Media articles that mention a CVE ID that affects a product developed by Mruby — matched by CVE ID, not by vendor name.