CVE-2025-12875
highpriority · track · 31EPSS 0.002 · 7 %ileDEEUUSEPSS · scored 2026-10-22
A weakness has been identified in mruby 3.4.0. This vulnerability affects the function ary_fill_exec of the file mrbgems/mruby-array-ext/src/array.c. Executing a manipulation of the argument start/length can lead to out-of-bounds write. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. This patch is called 93619f06dd378db6766666b30c08978311c7ec94. It is best practice to apply a patch to resolve this issue.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 1.1–7.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (18)
Products and version ranges known to be affected.
- Microsoft Azure Linux azl3 cmake 3.30.3-10 on 3.0all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3_cmake_3.30.3-10_on_3.0
- Microsoft Azure Linux azl3 containerd2 2.0.0-14 on 3.0all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3_containerd2_2.0.0-14_on_3.0
- Microsoft Azure Linux azl3 curl 8.11.1-4 on 3.0all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3_curl_8.11.1-4_on_3.0
- Microsoft Azure Linux azl3 kernel 6.6.104.2-4 on 3.0all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3_kernel_6.6.104.2-4_on_3.0
- Microsoft Azure Linux azl3 kubevirt 1.5.0-5 on 3.0all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3_kubevirt_1.5.0-5_on_3.0
- Microsoft Azure Linux azl3 libarchive 3.7.7-3 on 3.0all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3_libarchive_3.7.7-3_on_3.0
- Microsoft Azure Linux azl3 libxml2 2.11.5-7 on 3.0all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3_libxml2_2.11.5-7_on_3.0
- Microsoft Azure Linux azl3 mysql 8.0.44-2 on 3.0all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3_mysql_8.0.44-2_on_3.0
- Microsoft Azure Linux azl3 nghttp2 1.61.0-2 on 3.0all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3_nghttp2_1.61.0-2_on_3.0
- Microsoft Azure Linux azl3 runc 1.3.3-1 on 3.0all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3_runc_1.3.3-1_on_3.0
- Microsoft Azure Linux azl3 rust 1.75.0-21 on 3.0all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3_rust_1.75.0-21_on_3.0
- Microsoft Azure Linux azl3 rust 1.86.0-9 on 3.0all versionscert_bundDEcpe:/o:microsoft:azure_linux:azl3_rust_1.86.0-9_on_3.0
- Microsoft Windows Subsystem for Linux GUIall versionscert_bundDEcpe:/o:microsoft:windows:subsystem_for_linux_gui
advisories (1)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2025-2563Microsoft Azure Linux: Mehrere SchwachstellenDeutsch2025-11-11csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Microsoft Azure Linux und Microsoft Windows ausnutzen um erhöhte Privilegien zu erlangen, beliebigen Code auszuführen, die Authentifizierung zu umgehen, Spoofing-Angriffe durchzuführen, einen Denial-of-Service-Zustand zu verursachen oder andere, nicht näher spezifizierte Angriffe durchzuführen.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (25)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2025-12875cnnvd
- https://github.com/makesoftwaresafe/mruby/commit/93619f06dd378db6766666b30c08978311c7ec94cnnvd
- https://github.com/mruby/mruby/cnnvd
- https://github.com/mruby/mruby/issues/6650#event-20443453808cnnvd
- https://github.com/mruby/mruby/issues/6650#issuecomment-3430851605cnnvd
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-12875cnnvd
- https://vuldb.com/?ctiid.331511cnnvd
- https://vuldb.com/?id.331511cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan