CVE-2026-38973 identifies an out-of-bounds read vulnerability in mrubyc through version 3.4.1. The flaw exists in the builtin missing-method lookup mechanism within the function mrbc_find_method(), which can lead to reading memory outside the intended bounds. This vulnerability is categorized under CWE-125 (Out-of-bounds Read). The CVSS 3.1 base score is 4.4, reflecting a medium severity with local attack vector, low attack complexity, no privileges required, and requiring user interaction. The impact includes limited confidentiality loss and low availability impact. There is no vendor advisory or patch information available at this time.

The vulnerability allows an attacker with local access and the ability to interact with the system to cause an out-of-bounds read, potentially exposing sensitive information from memory (confidentiality impact is low). There is no indication of integrity impact, and availability impact is low, possibly causing minor disruptions. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit local user access and avoid untrusted user interactions with the affected mrubyc versions. Monitor vendor channels for updates or patches addressing this vulnerability.