CVE-2026-24809
Heap-Buffer Overflow in praydog REFramework luaG_runerror Component
Publication date: 2026-01-27
Last updated on: 2026-01-27
Assigner: Government Technology Agency of Singapore Cyber Security Group (GovTech CSG)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| praydog | reframework | to 1.5.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a heap-buffer overflow in the luaG_runerror function within the REFramework project before version 1.5.5. It occurs when a recursive error happens, causing improper error handling that leads to memory corruption. The issue stems from the luaG_runerror function not having received a critical security patch that was applied in the official Lua repository, which allowed excessive stack space usage and related security problems. This flaw was fixed by applying the official Lua patch to REFramework's codebase. [1]
How can this vulnerability impact me? :
This heap-buffer overflow vulnerability can lead to memory corruption, which may be exploited to cause crashes or potentially execute arbitrary code. Such impacts can compromise the stability and security of applications using the affected REFramework versions, possibly leading to denial of service or unauthorized actions within the affected environment. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the praydog/REFramework to version 1.5.5 or later, which includes the security fix for the luaG_runerror heap-buffer overflow issue. This fix applies the official Lua patch to the error handling code, preventing the vulnerability without requiring a Lua version upgrade. Applying this update will eliminate the heap-buffer overflow caused by recursive errors. [1]