← Vulnerability feed

Vulnerability record · CVE-2020-15888 · published 21 July 2020

CVE-2020-15888: Lua out-of-bounds read vulnerability

Lua · Lua

Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free.

8.8 CVSS 3.1 High EPSS 2.4% · top 16.4% CWE-125 · Out-of-bounds readCWE-416 · Use after free
8.8CVSS 3.1 base score, v2 6.8
2.4%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References, 8 tagged exploit
17 Jun 2026Last modified by NVD

Description

Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://lua-users.org/lists/lua-l/2020-07/msg00053.html ExploitMailing ListThird Party Advisory
http://lua-users.org/lists/lua-l/2020-07/msg00054.html ExploitMailing ListThird Party Advisory
http://lua-users.org/lists/lua-l/2020-07/msg00071.html ExploitMailing ListThird Party Advisory
http://lua-users.org/lists/lua-l/2020-07/msg00079.html ExploitMailing ListThird Party Advisory
https://github.com/lua/lua/commit/6298903e35217ab69c279056f925fb72900ce0b7 PatchThird Party Advisory
https://github.com/lua/lua/commit/eb41999461b6f428186c55abd95f4ce1a76217d5 PatchThird Party Advisory
http://lua-users.org/lists/lua-l/2020-07/msg00053.html ExploitMailing ListThird Party Advisory
http://lua-users.org/lists/lua-l/2020-07/msg00054.html ExploitMailing ListThird Party Advisory
http://lua-users.org/lists/lua-l/2020-07/msg00071.html ExploitMailing ListThird Party Advisory
http://lua-users.org/lists/lua-l/2020-07/msg00079.html ExploitMailing ListThird Party Advisory
https://github.com/lua/lua/commit/6298903e35217ab69c279056f925fb72900ce0b7 PatchThird Party Advisory
https://github.com/lua/lua/commit/eb41999461b6f428186c55abd95f4ce1a76217d5 PatchThird Party Advisory

Track CVE-2020-15888 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-15889Lua out-of-bounds read vulnerabilityLua 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list members.EPSS 2.2%9.1CVE-2022-28805Lua out-of-bounds read vulnerabilitysinglevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer o…EPSS 3.0%7.8CVE-2020-24342Lua memory buffer overflow vulnerabilityLua through 5.4.0 allows a stack redzone cross in luaO_pushvfstring because a protection mechanism wrongly calls luaD_callnoyield twice in a row.EPSS 1.1%7.5CVE-2021-45985Lua out-of-bounds write vulnerabilityIn Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read.EPSS 1.4%7.5CVE-2022-33099Lua out-of-bounds write vulnerabilityAn issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs.EPSS 2.8%7.5CVE-2020-24369Lua null pointer dereference vulnerabilityldebug.c in Lua 5.4.0 attempts to access debug information via the line hook of a stripped function, leading to a NULL pointer dereference.EPSS 1.7%7.5CVE-2019-6706Lua use after free vulnerabilityLua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to trigger a d…EPSS 17%6.3CVE-2021-44964Lua use after free vulnerabilityUse after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.0~5.4.3 allows attackers to perform Sandbox Escape via a crafted sc…EPSS 0.99%

Source: NIST National Vulnerability Database (record CVE-2020-15888), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.