{"id":"CVE-2018-10191","details":"In versions of mruby up to and including 1.4.0, an integer overflow exists in src/vm.c::mrb_vm_exec() when handling OP_GETUPVAR in the presence of deep scope nesting, resulting in a use-after-free. An attacker that can cause Ruby code to be run can use this to possibly execute arbitrary code.","modified":"2026-07-08T14:13:44.989567Z","published":"2018-04-17T21:29:00.233Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux","cpes":["cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"]}]},"references":[{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00006.html"},{"type":"REPORT","url":"https://github.com/mruby/mruby/issues/3995"},{"type":"FIX","url":"https://github.com/mruby/mruby/commit/1905091634a6a2925c911484434448e568330626"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mruby/mruby","events":[{"introduced":"0"},{"last_affected":"58fb6f421ad9824caae5a2cabb849d48647b90ec"},{"fixed":"1905091634a6a2925c911484434448e568330626"}],"database_specific":{"cpe":"cpe:2.3:a:mruby:mruby:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"1.4.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["1.4.0","1.2.0","1.1.0","1.0.0"],"database_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["318179098320671580796334812011546468836","31385894504806590158479134728976733374","291488986920338441806228910834754532837","234188554461621141776788455322527686487","12890778145267399150668197333810861362","46198236631767394421020263073167925398","315187527932322571882289740280446195103","295169726589021630819681535583790457470"],"threshold":0.9},"id":"CVE-2018-10191-4f906dc6","signature_type":"Line","signature_version":"v1","source":"https://github.com/mruby/mruby/commit/1905091634a6a2925c911484434448e568330626","target":{"file":"src/vm.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/mruby/mruby/commit/1905091634a6a2925c911484434448e568330626","target":{"file":"src/vm.c","function":"mrb_vm_exec"},"deprecated":false,"digest":{"function_hash":"105486956670678688502489234273124890437","length":34172},"id":"CVE-2018-10191-9de90541"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-10191.json","vanir_signatures_modified":"2026-07-08T14:13:44Z"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}