CVE-2013-4164: Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 prev...

Security readout for executives and security teams

CVE-2013-4164 is a Ruby memory corruption flaw triggered when certain strings are converted to floating point numbers. In affected Ruby versions, this can crash the process and may allow arbitrary code execution. Business risk is highest where old Ruby runtimes process untrusted JSON or numeric input. Exposure is likely limited to legacy Ruby installations or vendor-packaged Ruby runtimes that still match the affected version ranges. Internet-facing Rails or Ruby services parsing user-supplied JSON or numeric strings deserve priority review. Treat this as a legacy-runtime remediation item with high potential impact. It is not presented as actively exploited in the supplied sources, but vulnerable Ruby services can face process crashes and possible code execution if exposed to hostile input. Mitigation focus: Upgrade Ruby to 1.9.3-p484, 2.0.0-p353, 2.1 preview2 or later as applicable.; Apply vendor security updates from OS distributions that package Ruby.; Retire Ruby 1.8 and other unsupported runtime branches where feasible..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.