CVE-2026-86547

mrubyc, a lightweight Ruby VM designed for embedding in microcontroller and IoT firmware, contains a null pointer dereference (CWE-476) in the op_enter() handler of src/vm.c in all versions through 4.0.0. The flaw is triggered when the VM processes a crafted .mrb bytecode file containing an OP_ENTER instruction placed at the top level, causing a NULL dereference during execution. An attacker who can supply such bytecode to an embedding application gains denial of service, since the process crashes; the CVSS 4.0 score of 6.9 (local attack vector, high availability impact) reflects an availability-only issue with no confidentiality or integrity loss. Only applications that execute untrusted or attacker-supplied bytecode in mrubyc are realistically affected, while firmware running solely its own pre-compiled bytecode is not exposed. No in-the-wild exploitation is known and the issue is absent from CISA KEV, but a public proof-of-concept is available on GitHub.

What to do: No fixed version is confirmed in the available data, so monitor the mrubyc project for a patched release and update the embedded VM as soon as one is published. Until then, do not feed untrusted or third-party .mrb bytecode files into applications built on mrubyc 4.0.0 or earlier, and audit integrations for any path where user-supplied data can reach bytecode execution. Where untrusted bytecode must be processed, isolate the VM in a separate sandboxed process so a crash cannot take down the host application.