CVE-2025-12875: Mruby Buffer Overflow Vulnerability

CVE-2025-12875 Overview

CVE-2025-12875 is an out-of-bounds write vulnerability in mruby 3.4.0, a lightweight implementation of the Ruby programming language. The flaw resides in the ary_fill_exec function inside mrbgems/mruby-array-ext/src/array.c. Attackers can manipulate the start and length arguments of the array fill operation to write outside allocated bounds. The vulnerability requires local access and low privileges to exploit. A public exploit has been referenced in vendor discussions, and the maintainers issued patch commit 93619f06dd378db6766666b30c08978311c7ec94 to resolve the issue. This weakness is categorized under [CWE-119] and [CWE-787].

Critical Impact
Local attackers with low privileges can trigger an out-of-bounds write in mruby 3.4.0 by supplying crafted start and length values to the array fill operation, potentially corrupting adjacent memory.

Affected Products

mruby 3.4.0
Applications embedding mruby 3.4.0 with the mruby-array-ext mrbgem enabled
Downstream projects consuming vulnerable mruby builds

Discovery Timeline

2025-11-07 - CVE-2025-12875 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12875

Vulnerability Analysis

The vulnerability affects Array#fill, implemented by ary_fill_exec in mrbgems/mruby-array-ext/src/array.c. The function accepted start and length integer arguments without validating that they were non-negative. When a caller supplied negative values, the internal indexing arithmetic produced an out-of-bounds pointer used for writing element data. This memory-safety flaw falls under [CWE-787] (Out-of-Bounds Write) and the broader [CWE-119] category for improper buffer restriction.

Exploitation is constrained to local contexts where an attacker can execute mruby code, such as embedded scripting engines or applications that evaluate untrusted Ruby scripts. The impact scope is limited to memory corruption within the mruby process.

Root Cause

The root cause is missing input validation. The ary_fill_exec function parsed the start and length arguments using mrb_get_args(mrb, "iio", ...) but did not reject negative values before using them in pointer arithmetic against the array buffer. Negative operands bypassed the intended bounds calculation and produced writes past the end of the allocated array.

Attack Vector

An attacker able to run mruby scripts locally can call Array#fill with crafted negative arguments to corrupt memory adjacent to the array buffer. Because the attack vector is local and requires the ability to execute Ruby code within the target process, exploitation is limited to scenarios where mruby is used as an embedded interpreter for untrusted or user-controlled scripts.

// Security patch in mrbgems/mruby-array-ext/src/array.c
// mruby-array-ext: validate start and length in fill operation; fix #6650

  mrb_get_args(mrb, "iio", &start, &length, &obj);

+  if (start < 0) {
+    mrb_raise(mrb, E_ARGUMENT_ERROR, "negative start index");
+  }
+  if (length < 0) {
+    mrb_raise(mrb, E_ARGUMENT_ERROR, "negative length");
+  }
+
   struct RArray *ary = mrb_ary_ptr(self);
   mrb_int ary_len = ARY_LEN(ary);

Source: mruby patch commit 93619f06

The patch adds explicit guards that raise E_ARGUMENT_ERROR when either start or length is negative, preventing the malformed indices from reaching the write path.

Detection Methods for CVE-2025-12875

Indicators of Compromise

Unexpected crashes or aborts in processes embedding mruby 3.4.0 during array manipulation
Log entries showing Array#fill calls with negative arguments from untrusted script sources
Memory corruption signatures reported by AddressSanitizer or similar tooling when running mruby workloads

Detection Strategies

Inventory applications that ship or embed mruby 3.4.0 and verify whether the mruby-array-ext gem is compiled in
Perform static analysis on scripts to flag calls to Array#fill with variable or attacker-controlled arguments
Run fuzzing against mruby-based interpreters to surface out-of-bounds write conditions

Monitoring Recommendations

Track process crash telemetry from services that execute Ruby scripts through mruby
Enable core dump capture for mruby-embedded applications to identify memory corruption incidents
Monitor package manifests and software bills of materials for vulnerable mruby 3.4.0 dependencies

How to Mitigate CVE-2025-12875

Immediate Actions Required

Upgrade mruby to a build that includes commit 93619f06dd378db6766666b30c08978311c7ec94 or a later release
Rebuild and redeploy applications that statically link against mruby 3.4.0
Restrict execution of untrusted mruby scripts on affected systems until patches are applied

Patch Information

The mruby maintainers resolved the issue in commit 93619f06dd378db6766666b30c08978311c7ec94. The fix validates start and length in ary_fill_exec and raises an argument error on negative values. Additional context is available in mruby issue #6650 and the VulDB #331511 entry.

Workarounds

Disable or exclude the mruby-array-ext mrbgem from custom mruby builds where feasible
Sanitize or reject negative integer arguments before passing them to Array#fill in wrapper code
Sandbox mruby interpreters that process untrusted input using OS-level isolation such as seccomp or containers

bash

# Rebuild mruby from the patched source
git clone https://github.com/mruby/mruby.git
cd mruby
git checkout 93619f06dd378db6766666b30c08978311c7ec94
rake