CVE-2025-12875
Last modified
CVE-2025-12875 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. A weakness has been identified in mruby 3.4.0. This vulnerability affects the function ary_fill_exec of the file mrbgems/mruby-array-ext/src/array.c. EPSS estimates a 0.14% chance of exploitation in the next 30 days.
Description
A weakness has been identified in mruby 3.4.0. This vulnerability affects the function ary_fill_exec of the file mrbgems/mruby-array-ext/src/array.c. Executing a manipulation of the argument start/length can lead to out-of-bounds write. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. This patch is called 93619f06dd378db6766666b30c08978311c7ec94. It is best practice to apply a patch to resolve this issue.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mruby | Mruby | 3.4.0 |
References
- https://github.com/mruby/mruby/issues/6650Issue Tracking
- https://vuldb.com/?ctiid.331511Permissions Required, VDB Entry
- https://vuldb.com/?id.331511Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.680879Third Party Advisory, VDB Entry
- https://github.com/mruby/mruby/issues/6650Issue Tracking
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2025-12875?
How severe is CVE-2025-12875?
How do I fix CVE-2025-12875?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-1287The The Plus Addons for Elementor – Elementor Addons, Page T…5.4
- CVE-2025-12870The a+HRD developed by aEnrich has an Authentication Abuse v…9.8
- CVE-2025-12871The a+HRD developed by aEnrich has an Authentication Abuse v…9.8
- CVE-2025-12872The a+HRD and a+HCM developed by aEnrich has a Stored Cross-…5.4
- CVE-2025-12873A security flaw has been discovered in Campcodes School File…9.8
- CVE-2025-12874Inconsistent Interpretation of HTTP Requests ('HTTP Request/…6.3
- CVE-2025-12876The Projectopia – WordPress Project Management plugin for Wo…5.3
- CVE-2025-12877The IDonate – Blood Donation, Request And Donor Management S…5.3
- CVE-2025-12878The FunnelKit – Funnel Builder for WooCommerce Checkout plug…6.4
- CVE-2025-12879The User Generator and Importer plugin for WordPress is vuln…8.8
- CVE-2025-1288The WOOEXIM WordPress plugin through 5.0.0 does not have CS…6.1
- CVE-2025-12880The Progress Bar Blocks for Gutenberg plugin for WordPress i…5.4
Are you affected by CVE-2025-12875?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST