CVE-2026-24821

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24821", "assignerOrgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd", "state": "PUBLISHED", "assignerShortName": "GovTech CSG", "dateReserved": "2026-01-27T08:48:56.893Z", "datePublished": "2026-01-27T08:57:26.461Z", "dateUpdated": "2026-01-27T17:00:23.964Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://github.com/turanszkij/WickedEngine", "defaultStatus": "affected", "modules": ["WickedEngine/LUA"], "product": "WickedEngine", "programFiles": ["lparser.c"], "vendor": "turanszkij", "versions": [{"lessThanOrEqual": "0.71.727", "status": "affected", "version": "0", "versionType": "git"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "TITAN Team (titancaproject@gmail.com)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Out-of-bounds Read vulnerability in turanszkij WickedEngine (WickedEngine/LUA modules).<p> This vulnerability is associated with program files <tt>lparser.C</tt>.</p><p>This issue affects WickedEngine: through 0.71.727.</p>"}], "value": "Out-of-bounds Read vulnerability in turanszkij WickedEngine (WickedEngine/LUA modules). This vulnerability is associated with program files lparser.C.\n\nThis issue affects WickedEngine: through 0.71.727."}], "metrics": [{"cvssV4_0": {"Automatable": "YES", "Recovery": "USER", "Safety": "NEGLIGIBLE", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "AMBER", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:H/SI:N/SA:H/S:N/AU:Y/R:U/V:D/RE:M/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "MODERATE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd", "shortName": "GovTech CSG", "dateUpdated": "2026-01-27T08:57:26.461Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/turanszkij/WickedEngine/pull/1095"}], "source": {"discovery": "UNKNOWN"}, "title": "A heap-based buffer over-read that might affect a system that compiles untrusted Lua code in turanszkij/WickedEngine.", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-27T17:00:14.272814Z", "id": "CVE-2026-24821", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T17:00:23.964Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24821", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-27T17:00:14.272814Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T17:00:19.960Z"}}], "cna": {"title": "A heap-based buffer over-read that might affect a system that compiles untrusted Lua code in turanszkij/WickedEngine.", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "TITAN Team (titancaproject@gmail.com)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NEGLIGIBLE", "version": "4.0", "Recovery": "USER", "baseScore": 9.3, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:H/SI:N/SA:H/S:N/AU:Y/R:U/V:D/RE:M/U:Amber", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "turanszkij", "modules": ["WickedEngine/LUA"], "product": "WickedEngine", "versions": [{"status": "affected", "version": "0", "versionType": "git", "lessThanOrEqual": "0.71.727"}], "programFiles": ["lparser.c"], "collectionURL": "https://github.com/turanszkij/WickedEngine", "defaultStatus": "affected"}], "references": [{"url": "https://github.com/turanszkij/WickedEngine/pull/1095", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Out-of-bounds Read vulnerability in turanszkij WickedEngine (WickedEngine/LUA modules). This vulnerability is associated with program files lparser.C.\n\nThis issue affects WickedEngine: through 0.71.727.", "supportingMedia": [{"type": "text/html", "value": "Out-of-bounds Read vulnerability in turanszkij WickedEngine (WickedEngine/LUA modules).<p> This vulnerability is associated with program files <tt>lparser.C</tt>.</p><p>This issue affects WickedEngine: through 0.71.727.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd", "shortName": "GovTech CSG", "dateUpdated": "2026-01-27T08:57:26.461Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24821", "state": "PUBLISHED", "dateUpdated": "2026-01-27T17:00:23.964Z", "dateReserved": "2026-01-27T08:48:56.893Z", "assignerOrgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd", "datePublished": "2026-01-27T08:57:26.461Z", "assignerShortName": "GovTech CSG"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/turanszkij/WickedEngine", "defaultStatus": "affected", "modules": ["WickedEngine/LUA"], "product": "WickedEngine", "programFiles": ["lparser.c"], "vendor": "turanszkij", "versions": [{"lessThanOrEqual": "0.71.727", "status": "affected", "version": "0", "versionType": "git"}]}], "source": "cve_disclosure@tech.gov.sg"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Out-of-bounds Read vulnerability in turanszkij WickedEngine (WickedEngine/LUA modules). This vulnerability is associated with program files lparser.C.\n\nThis issue affects WickedEngine: through 0.71.727."}, {"lang": "es", "value": "Vulnerabilidad de lectura fuera de l\u00edmites en turanszkij WickedEngine (m\u00f3dulos de WickedEngine/LUA). Esta vulnerabilidad est\u00e1 asociada con los archivos de programa lparser.C.\n\nEste problema afecta a WickedEngine: hasta la versi\u00f3n 0.71.727."}], "id": "CVE-2026-24821", "lastModified": "2026-06-17T10:23:39.077", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "USER", "Safety": "NEGLIGIBLE", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "AMBER", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:H/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "MODERATE"}, "source": "cve_disclosure@tech.gov.sg", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24821", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-27T17:00:14.272814Z", "version": "2.0.3"}}]}, "published": "2026-01-27T09:15:52.797", "references": [{"source": "cve_disclosure@tech.gov.sg", "url": "https://github.com/turanszkij/WickedEngine/pull/1095"}], "sourceIdentifier": "cve_disclosure@tech.gov.sg", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "cve_disclosure@tech.gov.sg", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T02:19:35.345972+00:00", "value": {"mitigation_remediation": ["Upgrade WickedEngine to a version later than 0.71.727 to eliminate the out-of-bounds read.", "If an upgrade cannot be performed immediately, run the engine in a sandbox or otherwise restrict the execution of untrusted Lua scripts to limit the potential impact of the over-read.", "Implement input validation that checks the size and bounds of Lua bytecode before passing it to the parser to mitigate the risk of the buffer over-read."], "summary": {"action": "Upgrade", "impact": "Information Disclosure via buffer over-read"}, "threat_synthesis": {"affected_systems": "The affected product is WickedEngine from turanszkij, in all releases through version 0.71.727. Lua modules that parse scripts using lparser.C are vulnerable.", "description_and_impact": "The vulnerability is an out-of-bounds read in the Lua parser component of WickedEngine, which can expose internal memory contents when untrusted Lua scripts are compiled. This introduces a high risk of information disclosure. Identified by CWE-125, the flaw allows attackers to read beyond the bounds of a heap buffer, potentially revealing sensitive data.", "risk_and_exploitability": "The flaw carries a CVSS score of 9.3, indicating high severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation in the near term. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector requires the ability to submit malicious Lua code to the engine, either locally or over a network interface exposed by the application."}}}}, "created": "2026-01-27T20:17:09.623335+00:00", "updated": "2026-04-18T02:30:15.860128+00:00", "vendors": ["turanszkij", "turanszkij$PRODUCT$wickedengine"]}