From f49bd10e2dae3c8f69f47ccec430d1631f9856d6 Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Mon, 20 Jul 2026 13:34:16 -0400
Subject: [PATCH] Two new mrubyc advisories

---
 rubies/mrubyc/CVE-2026-38973.yml | 24 ++++++++++++++++++++++++
 rubies/mrubyc/CVE-2026-38976.yml | 25 +++++++++++++++++++++++++
 2 files changed, 49 insertions(+)
 create mode 100644 rubies/mrubyc/CVE-2026-38973.yml
 create mode 100644 rubies/mrubyc/CVE-2026-38976.yml

diff --git a/rubies/mrubyc/CVE-2026-38973.yml b/rubies/mrubyc/CVE-2026-38973.yml
new file mode 100644
index 0000000000..ad3b353645
--- /dev/null
+++ b/rubies/mrubyc/CVE-2026-38973.yml
@@ -0,0 +1,24 @@
+---
+engine: mrubyc
+cve: 2026-38973
+ghsa: r4w3-7jp7-m9g5
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-38973
+title: mrubyc through release3.4.1 was found to contain an out of bounds read
+date: 2026-07-06
+description: |
+  mrubyc through release 3.4.1 was found to contain an out-of-bounds
+  read in builtin missing-method lookup inside mrbc_find_method().
+cvss_v3: 4.4
+patched_versions:
+  - ">= 4.0.0"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-38973
+    - https://github.com/mrubyc/mrubyc/releases/tag/release4.0.0
+    - https://github.com/mrubyc/mrubyc/compare/release3.4.1...release4.0.0
+    - https://github.com/mrubyc/mrubyc/commit/f83a8b67ca1c7c62ac0dd548a363d79f767c4e30
+    - https://github.com/mrubyc/mrubyc/issues/279
+    - https://github.com/advisories/GHSA-r4w3-7jp7-m9g5
+notes: |
+  - cvss_v3 and date came from nvd.nist.gov URL.
+  - GHSA is unreviewed.
diff --git a/rubies/mrubyc/CVE-2026-38976.yml b/rubies/mrubyc/CVE-2026-38976.yml
new file mode 100644
index 0000000000..7dec660977
--- /dev/null
+++ b/rubies/mrubyc/CVE-2026-38976.yml
@@ -0,0 +1,25 @@
+---
+engine: mrubyc
+cve: 2026-38976
+ghsa: ff2c-rpvx-jp6m
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-38976
+title: mrubyc through 3.4.1 was found to contain a NULL pointer dereference
+date: 2026-07-06
+description: |
+  mrubyc through 3.4.1 was found to contain a NULL pointer dereference
+  in src/vm.c in op_super() / OP_SUPER due to a missing runtime
+  guard for top-level super.
+cvss_v3: 7.5
+patched_versions:
+  - ">= 4.0.0"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-38976
+    - https://github.com/mrubyc/mrubyc/releases/tag/release4.0.0
+    - https://github.com/mrubyc/mrubyc/compare/release3.4.1...release4.0.0
+    - https://github.com/hayat01sh1da/mrubyc/commit/c4aa2a06bfdd13a0f1ae5165c5760a2530314a42
+    - https://github.com/mrubyc/mrubyc/issues/276
+    - https://github.com/advisories/GHSA-ff2c-rpvx-jp6m
+notes: |
+  - cvss_v3 and date came from nvd.nist.gov URL.
+  - GHSA is unreviewed.