CVE-2025-13120

A vulnerability has been found in mruby up to 3.4.0. This vulnerability affects the function sort_cmp of the file src/array.c. Such manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The name of the patch is eb398971bfb43c38db3e04528b68ac9a7ce509bc. It is advisable to implement a patch to correct this issue.

• CWE-119
• CWE-416

• https://github.com/makesoftwaresafe/mruby/pull/263Issue Tracking
• https://github.com/mruby/mruby/
• https://github.com/mruby/mruby/commit/eb398971bfb43c38db3e04528b68ac9a7ce509bcPatch
• https://github.com/mruby/mruby/issues/6649Issue Tracking, Vendor Advisory
• https://github.com/mruby/mruby/issues/6649#issue-3534393003Issue Tracking, Vendor Advisory
• https://vuldb.com/?ctiid.332325Permissions Required, VDB Entry
• https://vuldb.com/?id.332325Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.683435Third Party Advisory, VDB Entry

Published

Nov 13, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-13115A security flaw has been discovered in macrozheng mall-swarm…5.3
• CVE-2025-13116A weakness has been identified in macrozheng mall-swarm and …5.3
• CVE-2025-13117A security vulnerability has been detected in macrozheng mal…5.3
• CVE-2025-13118A vulnerability was detected in macrozheng mall-swarm up to …4.3
• CVE-2025-13119A flaw has been found in Fabian Ros/SourceCodester Simple E-…6.5
• CVE-2025-1312The Ultimate Blocks – WordPress Blocks Plugin plugin for Wor…6.4
• CVE-2025-13121A security vulnerability has been detected in cameasy Likete…7.3
• CVE-2025-13122A vulnerability was detected in SourceCodester Patients Wait…9.8
• CVE-2025-13123A flaw has been found in AMTT Hotel Broadband Operation Syst…9.8
• CVE-2025-13124Authorization Bypass Through User-Controlled Key vulnerabili…7.6
• CVE-2025-13125Authorization Bypass Through User-Controlled Key vulnerabili…4.3
• CVE-2025-13126The wpForo Forum plugin for WordPress is vulnerable to gener…7.5