Medium severity · published Aug 19, 2026
CVE-2022-4996
mruby bigint.c udiv floating point comparison with incorrect operator
5.3
CVSS
0.6%
EPSS
No
On KEV
Description
A flaw has been found in mruby 3.1.0. Affected is the function udiv of the file bigint.c. Executing a manipulation can lead to floating point comparison with incorrect operator. It is possible to launch the attack remotely. The exploit has been published and may be used. It is best practice to apply a patch to resolve this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MR
mruby · Mruby
3.1.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-4996
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-4996
huntr.com
https://huntr.com/bounties/5a5092df-1699-4497-a8b2-38318bce0c4e
vuldb.com
https://vuldb.com/cve/CVE-2022-4996
vuldb.com
https://vuldb.com/submit/877513
vuldb.com
https://vuldb.com/vuln/391391
vuldb.com
https://vuldb.com/vuln/391391/cti
More from mruby
9.8
CVE-2022-1286
heap-buffer-overflow in mrb_vm_exec in mruby/mruby in GitHub repository mruby/mruby prior to 3.2
9.8
CVE-2022-1276
Out-of-bounds Read in mrb_get_args in GitHub repository mruby/mruby prior to 3.2
9.8
CVE-2022-1212
Use-After-Free in str_escape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2
9.8
CVE-2022-0631
Heap-based Buffer Overflow in Homebrew mruby prior to 3.2
9.8
CVE-2022-0570
Heap-based Buffer Overflow in Homebrew mruby prior to 3.2