CVE-2020-36401

mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free).

7.8 HighFix available

mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free).

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.99%Up 0.2 points since Jul 1, 2021

What each source reports

NVD Score used 7.8

mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free).

Record: CVE-2020-36401
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-415
Updated: 2026-11-02

CVE List No score

mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free).

Record: CVE-2020-36401
Updated: 2026-11-02

EUVDEUVD-2020-23929 No score

mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free).

Record: EUVD-2020-23929
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qq64-7fh7-7hmw No score

mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free).

mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free).

Record: GHSA-qq64-7fh7-7hmw
Weakness: CWE-415
Updated: 2026-11-02

OSV 7.8

mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free).

Record: CVE-2020-36401
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2020-36401 7.8

mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free).

Record: DEBIAN-CVE-2020-36401
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2020-36401 7.8

mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free).

Record: UBUNTU-CVE-2020-36401
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

mruby

Affected packages

Affected packages
Package	Affected	Fixed
`mruby` Debian:12	before 2.1.2-3	2.1.2-3
`mruby` Debian:13	before 2.1.2-3	2.1.2-3
`mruby` Debian:14	before 2.1.2-3	2.1.2-3
`mruby` Ubuntu:16.04:LTS	All versions, plus listed versions 1.1.0+20150817+gita1731254-11.1.0+20150906+git1cbbb7e1-11.2.0+20160315+git4f20d58a-1	None known
`mruby` Ubuntu:18.04:LTS	All versions, plus listed versions 1.3.0-11.3.0+20170925+git38185028-11.3.0+20171029+git77edafb0-11.4.0-1	None known
`mruby` Ubuntu:20.04:LTS	All versions, plus listed versions 2.0.0-1	None known
`mruby` Ubuntu:22.04:LTS	All versions, plus listed versions 2.1.2-33.0.0-13.0.0-3	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-36401 is a high vulnerability (CVSS 7.8) in Mruby, published July 1, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.99%, the 62nd percentile. Fixed in mruby 2.1.2-3.

Attack profile

How easy it is to exploit

What an attacker can affect

Exploit likelihood

What each source reports

Affected products

Affected packages

History

In short

References