CVE-2026-38973: mrubyc Buffer Overflow Vulnerability

CVE-2026-38973 Overview

CVE-2026-38973 is an out-of-bounds read vulnerability in mrubyc, a lightweight Ruby-compatible virtual machine designed for microcontrollers and embedded systems. The flaw affects mrubyc through release 3.4.1 and resides in the builtin missing-method lookup logic inside the mrbc_find_method() function in src/class.c. When the runtime searches for a method that does not exist, an off-by-one boundary condition triggers a read outside the intended method_symbols array. The issue is tracked under [CWE-125: Out-of-bounds Read].

Critical Impact
A local attacker who can supply crafted Ruby bytecode to a mrubyc runtime can trigger an out-of-bounds memory read, potentially leaking small amounts of adjacent memory or causing the VM to crash.

Affected Products

mrubyc versions through release 3.4.1
Embedded firmware and IoT devices bundling the vulnerable mrubyc VM
Applications linking mrubyc as a scripting runtime prior to commit f83a8b6

Discovery Timeline

2026-07-06 - CVE-2026-38973 published to the National Vulnerability Database (NVD)
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-38973

Vulnerability Analysis

The vulnerability lives in mrbc_find_method(), which performs a binary search over a sorted table of built-in method symbol identifiers. The search uses two indices, left and right, where right is initialized to c->num_builtin_method. During iteration, the midpoint index mid is computed as (left + right) / 2 and used to dereference c->method_symbols[mid]. Because right is set to the count of methods rather than the last valid index, the binary search can compute a mid value equal to num_builtin_method, reading one element past the end of the array. When a lookup fails, such as during the missing-method resolution path, this out-of-bounds access is reachable through normal Ruby method dispatch.

Root Cause

The root cause is an off-by-one error in the initialization of the binary search upper bound. The code treats num_builtin_method as an inclusive upper index rather than an exclusive count. Combined with the removal of a defensive assertion (assert( cls->flag_builtin )), the boundary miscalculation is not caught at runtime in release builds. The upstream fix decrements right before the loop begins, restoring the correct half-open interval invariant.

Attack Vector

Exploitation requires local access and user interaction, since an attacker must convince the target to execute crafted mrubyc bytecode or Ruby source containing a call to a non-existent method on a builtin class. The impact is limited to low-severity information disclosure and availability loss. The vulnerability cannot be triggered over the network without an intermediary application that accepts untrusted scripts.

// Security patch in src/class.c - mrbc_find_method()
// Source: https://github.com/mrubyc/mrubyc/commit/f83a8b67ca1c7c62ac0dd548a363d79f767c4e30
     struct RBuiltinClass *c = (struct RBuiltinClass *)cls;
     int right = c->num_builtin_method;
     if( right == 0 ) goto next_class;
+    right--;
     int left = 0;
 
-    assert( cls->flag_builtin );
     while( left < right ) {
       int mid = (left + right) / 2;
       if( c->method_symbols[mid] < sym_id ) {

Detection Methods for CVE-2026-38973

Indicators of Compromise

Unexpected crashes or segmentation faults in processes hosting the mrubyc runtime, particularly during method dispatch
Firmware or application logs referencing faults inside mrbc_find_method or the class resolution path
Deployment of mrubyc binaries built from source trees at or below release 3.4.1 without commit f83a8b6 applied

Detection Strategies

Perform software composition analysis on firmware images and embedded binaries to identify vulnerable mrubyc versions
Run mrubyc-hosting binaries under AddressSanitizer or Valgrind in test environments to surface the out-of-bounds read
Review CI/CD pipelines for pinned mrubyc dependencies and flag versions predating the upstream fix

Monitoring Recommendations

Monitor embedded device telemetry for repeated VM restarts or watchdog resets that may indicate crash-based abuse
Track upstream mrubyc GitHub releases and security advisories for backported fixes
Log and inspect any ingestion of user-supplied Ruby scripts or .mrb bytecode files by mrubyc-enabled applications

How to Mitigate CVE-2026-38973

Immediate Actions Required

Rebuild mrubyc from a source tree that includes commit f83a8b67ca1c7c62ac0dd548a363d79f767c4e30 and redeploy affected firmware
Inventory all products and services embedding mrubyc through release 3.4.1 and prioritize those that accept untrusted Ruby input
Restrict execution of externally supplied bytecode until patched binaries are deployed

Patch Information

The upstream fix is available in the mrubyc repository via commit f83a8b6. The patch decrements right so that the binary search operates over a valid inclusive range and removes the release-build assertion that provided no runtime protection. Downstream integrators should rebase onto the post-3.4.1 main branch or apply the commit as a backport. Refer to the mrubyc project repository and issue 279 for tracking discussion.

Workarounds

Disallow loading of untrusted .mrb bytecode or Ruby source in applications that embed mrubyc
Sandbox the mrubyc process with reduced privileges and memory isolation to contain crash impact
Enable compiler hardening flags such as -fsanitize=bounds in development builds to catch related boundary errors early

bash

# Apply the upstream fix to a local mrubyc checkout
git clone https://github.com/mrubyc/mrubyc.git
cd mrubyc
git cherry-pick f83a8b67ca1c7c62ac0dd548a363d79f767c4e30
make clean && make