CVE-2026-24817
Unknown Unknown - Not Provided
Out-of-Bounds Write in praydog UEVR Lua Modules

Publication date: 2026-01-27

Last updated on: 2026-01-27

Assigner: Government Technology Agency of Singapore Cyber Security Group (GovTech CSG)

Description
Out-of-bounds Write vulnerability in praydog UEVR (dependencies/lua/src modules). This vulnerability is associated with program files ldebug.C, lvm.C. This issue affects UEVR: before 1.05.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-27
Last Modified
2026-01-27
Generated
2026-06-16
AI Q&A
2026-01-27
EPSS Evaluated
2026-06-15
NVD
CVE-2026-24817
EUVD
EUVD-2026-4766
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
praydog uevr to 1.05 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-24817 is an out-of-bounds write vulnerability in the UEVR project, specifically in the error handling function luaG_runerror(). This function was cloned from the Lua programming language but missed a critical security patch that fixed a similar issue in Lua. The vulnerability could cause improper memory handling when errors occur, potentially leading to exploitation. The issue was fixed by backporting the Lua security patch to UEVR, improving the function's robustness and preventing the out-of-bounds write. [1]

Impact Analysis

This vulnerability can lead to an out-of-bounds write, which may allow an attacker to corrupt memory, cause crashes, or execute arbitrary code. Since the vulnerability exists in the error handling function, it could be triggered during error conditions, potentially compromising the security and stability of applications using UEVR before version 1.05. [1]

Mitigation Strategies

To mitigate this vulnerability, you should update UEVR to include the security patch applied in pull request #336, which fixes the luaG_runerror() function by backporting a critical Lua security patch. This patch was merged into the master branch on April 25, 2025. Avoid upgrading the entire Lua version to maintain compatibility with UE4SS as per the maintainer's guidance. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-24817. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart