A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0. (CVE-2026-79590)

CVE-2026-79590 describes a NULL pointer dereference vulnerability in the Prism parser component of mruby version 4.0.0. The flaw occurs when the parser processes a maliciously crafted Ruby source file that leads to passing a NULL pointer to functions expecting nonnull string arguments. This causes undefined behavior and crashes the application. The vulnerability affects multiple specific versions of mruby, including versions from 1.1.0+20150817+gita1731254-1 through 4.0.0-1 and several intermediate releases. The CVSS 3.1 base score is 6.5, with attack vector network, low attack complexity, no privileges required, user interaction required, scope unchanged, no confidentiality or integrity impact, and high availability impact.

Successful exploitation causes an application crash due to a NULL pointer dereference, resulting in denial of service. There is no impact on confidentiality or integrity according to the CVSS vector. The vulnerability requires user interaction and can be triggered remotely over the network without privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, avoid processing untrusted Ruby source files with the affected versions of mruby to mitigate risk.