CVE-2026-24818
Unknown Unknown - Not Provided
Out-of-Bounds Read in praydog UEVR lparser.C Module

Publication date: 2026-01-27

Last updated on: 2026-01-27

Assigner: Government Technology Agency of Singapore Cyber Security Group (GovTech CSG)

Description
Out-of-bounds Read vulnerability in praydog UEVR (dependencies/lua/src modules). This vulnerability is associated with program files lparser.C. This issue affects UEVR: before 1.05.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-27
Last Modified
2026-01-27
Generated
2026-06-16
AI Q&A
2026-01-27
EPSS Evaluated
2026-06-15
NVD
CVE-2026-24818
EUVD
EUVD-2026-4767
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
praydog uevr to 1.05 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read issue in the Lua scripting language implementation within the UEVR project, specifically in the singlevar() function. The problem arises when the _ENV variable is marked as constant (<const>), causing Lua to generate incorrect code. This flaw was originally fixed in the official Lua repository but was not applied to UEVR until a security patch was merged. The patch prevents Lua from generating wrong code under the condition where _ENV is constant. [1]

Impact Analysis

This vulnerability can lead to incorrect code execution in the Lua scripting environment of UEVR, potentially causing unexpected behavior or security issues such as memory corruption or crashes due to out-of-bounds reads. This could be exploited by an attacker to compromise the integrity or stability of applications using the affected UEVR versions before 1.05. [1]

Mitigation Strategies

To mitigate this vulnerability, update the UEVR project to version 1.05 or later, which includes the security patch fixing the out-of-bounds read issue in the Lua `singlevar()` function. This patch prevents Lua from generating incorrect code when the `_ENV` variable is marked as <const>. Applying the patch from pull request #337 or upgrading to the fixed version will address the vulnerability. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-24818. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart