Medium severity · published Nov 13, 2025
CVE-2025-13120
mruby array.c sort_cmp use after free
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability has been found in mruby up to 3.4.0. This vulnerability affects the function sort_cmp of the file src/array.c. Such manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The name of the patch is eb398971bfb43c38db3e04528b68ac9a7ce509bc. It is advisable to implement a patch to correct this issue.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MR
mruby · Mruby
3.0; 3.1; 3.2; 3.3; 3.4.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13120
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13120
Issue Tracking
https://github.com/makesoftwaresafe/mruby/pull/263
github.com
https://github.com/mruby/mruby/
Patch
https://github.com/mruby/mruby/commit/eb398971bfb43c38db3e04528b68ac9a7ce509bc
Issue Tracking
https://github.com/mruby/mruby/issues/6649
Issue Tracking
https://github.com/mruby/mruby/issues/6649#issue-3534393003
Permissions Required
https://vuldb.com/?ctiid.332325
More from mruby
9.8
CVE-2022-1286
heap-buffer-overflow in mrb_vm_exec in mruby/mruby in GitHub repository mruby/mruby prior to 3.2
9.8
CVE-2022-1276
Out-of-bounds Read in mrb_get_args in GitHub repository mruby/mruby prior to 3.2
9.8
CVE-2022-1212
Use-After-Free in str_escape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2
9.8
CVE-2022-0631
Heap-based Buffer Overflow in Homebrew mruby prior to 3.2
9.8
CVE-2022-0570
Heap-based Buffer Overflow in Homebrew mruby prior to 3.2