CVE-2026-1979: 
NixOS vulnerability analysis and mitigation

CVE-2026-1979 is a heap use-after-free vulnerability in mruby (the lightweight Ruby implementation) affecting all versions up to and including 3.4.0. The flaw resides in the mrb_vm_exec function within src/vm.c, triggered by an interaction between the VM's JMPNOT-to-JMPIF bytecode optimization and the mruby-rational/mruby-bigint extensions during rational number reduction operations. It was reported on January 12, 2026, publicly disclosed on February 6, 2026, and a patch was committed on February 27, 2026. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 1.9 (Low) (Feedly, GitHub Issue).

The root cause is a use-after-free (CWE-416) combined with improper memory buffer handling (CWE-119) in the mruby VM's pattern matching bytecode optimizer. Specifically, the JMPNOT-to-JMPIF optimization in mrbgems/mruby-compiler/core/codegen.c incorrectly assumed that fail_pos always originated from a 4-byte JMPNOT instruction; when a pinned variable is undefined, NODE_PAT_PIN generates a 3-byte OP_JMP instead, causing fail_pos - 2 to point into the previous instruction and corrupt its operand (GitHub Commit). At runtime, the VM executes code creating a Rational number from BigInts; during GCD calculation in mrb_bint_reduce → mpz_gcd, temporary BigInt memory is freed via mrb_basic_alloc_func, but mrb_vm_exec retains a dangling pointer and subsequently reads 4 bytes from the freed region at src/vm.c:1953 (GitHub Issue). Exploitation requires local access with low privileges and no user interaction. A proof-of-concept input string has been publicly disclosed (GitHub Issue).

Successful exploitation primarily impacts availability — the dangling pointer read causes an abnormal process termination (crash/abort), as confirmed by the ASAN report showing ==ABORTING (GitHub Issue). Under CVSS v3.1, there is no confidentiality or integrity impact, only high availability impact. However, use-after-free vulnerabilities of this class carry a theoretical risk of memory corruption that could, in more complex exploitation scenarios, lead to limited information disclosure or code execution, as reflected in the CVSS v4.0 scoring which notes low confidentiality and integrity impacts (Feedly). The scope is limited to the affected mruby process and does not propagate to other system components.

A proof-of-concept exploit (a crafted mruby script) has been publicly disclosed in the mruby GitHub issue tracker and is available for use (GitHub Issue). The CVSS v4.0 exploit maturity is rated PROOF_OF_CONCEPT. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported (Feedly). The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection is available via Tenable Nessus plugin 298288 (Tenable).

1. Obtain access: Gain local access to a system running mruby ≤ 3.4.0 with low-privilege credentials (e.g., a standard user account or a sandboxed process that can invoke the mruby interpreter).
2. Craft malicious input: Prepare a mruby script that triggers rational number creation from BigInt values, causing the GCD reduction path to execute. The publicly disclosed PoC input is: 3-24/3r**433-2244r**-433;RR=>^ı0ıı;ıÙıRR=>^˙˙ıı;ı˙˙o3-433-2243-33-24/3r**433-2244r**-433;33-4244r**33-U44 (GitHub Issue).
3. Execute the payload: Run the crafted script with the mruby interpreter: ./bin/mruby poc.
4. Trigger the use-after-free: The VM executes the rational number operation, rational_new_b → mrb_bint_reduce → mpz_gcd frees heap memory, and mrb_vm_exec at src/vm.c:1953 reads from the freed region, causing a heap-use-after-free and process crash (GitHub Issue).

• Process: Unexpected crash or abort of the mruby interpreter process (./bin/mruby); ASAN output containing heap-use-after-free on address ... in mrb_vm_exec /src/mruby/src/vm.c:1953.
• Logs: Application logs showing abnormal termination of mruby processes; crash dumps referencing mrb_vm_exec, rational_new_b, mrb_bint_reduce, or mpz_gcd in the stack trace.
• File System: Presence of a crafted mruby script file containing unusual rational number expressions with BigInt operations (e.g., patterns like r** combined with large integer literals and semicolon-separated expressions).
• Network: No network indicators expected, as this is a local attack vector.

Apply the fix introduced in commit e50f15c1c6e131fa7934355eb02b8173b13df415, which adds a check to verify that the instruction at fail_pos - 2 is actually OP_JMPNOT before modifying it in the JMPNOT-to-JMPIF optimization (GitHub Commit). Users should update to a version of mruby that includes this commit (post-3.4.0 builds from the patched repository). As a workaround where immediate patching is not possible, restrict local access to mruby processes and minimize the privilege level of accounts that can invoke the interpreter to reduce the attack surface (Feedly).

Red Hat has acknowledged the vulnerability and published a security advisory tracking it (Red Hat). Microsoft's Security Response Center also references the CVE (MSRC). The vulnerability was assigned and initially reported via VulDB. No significant broader community or social media discussion has been identified beyond standard vulnerability database aggregation.