CVE-2025-12875 | mruby 3.4.0 array.c ary_fill_exec start/length out-of-bounds write (Issue 6650)

A vulnerability was found in mruby 3.4.0 and classified as critical. This vulnerability affects the function ary_fill_exec of the file mrbgems/mruby-array-ext/src/array.c. Executing manipulation of the argument start/length can lead to out-of-bounds write.

This vulnerability is registered as CVE-2025-12875. The attack needs to be launched locally. Furthermore, an exploit is available.

It is best practice to apply a patch to resolve this issue.