Lua is a lightweight, widely embedded scripting language used across a broad ecosystem of applications, game engines, and systems software, making its interpreter a deceptively high-impact component despite the narrow product scope. Vulnerabilities in the Lua interpreter skew toward serious outcomes and tend to acquire public exploit code; they recur through memory-safety weakness classes including out-of-bounds reads and writes, use-after-free conditions, type confusion, and improper buffer-boundary enforcement that reflect the interpreter's C implementation and tight integration with host systems. Defenders should track Lua interpreter updates closely wherever the runtime is embedded, as a single flaw can affect numerous downstream products; current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Lua over time
Signals from CVEs in this vendor scope (17 CVEs).
17 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-6706HIGH Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which | Jan 23, 2019 | 7.5 | 44 | NO | YES |
CVE-2022-33099HIGH An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs. | Jul 1, 2022 | 7.5 | 27 | NO | NO |
CVE-2021-45985HIGH In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read. | Apr 10, 2023 | 7.5 | 25 | NO | NO |
CVE-2020-24342HIGH Lua through 5.4.0 allows a stack redzone cross in luaO_pushvfstring because a protection mechanism wrongly calls luaD_callnoyield twice in a row. | Aug 13, 2020 | 7.8 | 25 | NO | NO |
CVE-2021-32918HIGH An issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-service (DoS) attacks via memory exhaustion when running unde | May 13, 2021 | 7.5 | 24 | NO | NO |
CVE-2020-15889CRITICAL Lua 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list members. | Jul 21, 2020 | 9.8 | 24 | NO | NO |
CVE-2020-15888HIGH Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free. | Jul 21, 2020 | 8.8 | 24 | NO | NO |
CVE-2014-5461MEDIUM Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of | Sep 4, 2014 | 5.0 | 24 | NO | NO |
CVE-2022-28805CRITICAL singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a sy | Apr 8, 2022 | 9.1 | 23 | NO | NO |
CVE-2020-24369HIGH ldebug.c in Lua 5.4.0 attempts to access debug information via the line hook of a stripped function, leading to a NULL pointer dereference. | Aug 17, 2020 | 7.5 | 23 | NO | NO |
Signals from CVEs in this vendor scope (17 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Lua.
Media articles that mention a CVE ID that affects a product developed by Lua — matched by CVE ID, not by vendor name.