A heap-based buffer over-read has been assigned CVE-2026-24821 after researchers identified a flaw in the Lua parsing code of turanszkij’s WickedEngine that can be triggered when the engine compiles untrusted Lua code; the flaw is rooted in lparser.C and affects WickedEngine releases through...
The Lua interpreter received a critical security fix in 2022 after researchers discovered that a missing internal call in lparser.c’s singlevar function allowed a heap-based buffer over-read when compiling certain crafted scripts—an issue tracked as CVE-2022-28805 that affects Lua releases 5.4.0...
