VULNERABILITY INTELLIGENCE

CVE-2018-10199

CVSS score9.8 CRITICAL
EPSS probability2.26%
CISA KEVNot currently listed
Published2018-04-18
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

In versions of mruby up to and including 1.4.0, a use-after-free vulnerability exists in src/io.c::File#initilialize_copy(). An attacker that can cause Ruby code to be run can possibly use this to execute arbitrary code.

Weakness classification

  • CWE-416: Use After Free

Primary references