CVE-2022-28805 singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call leading to a heap-based buffer over

Api.Msrc.Microsoft • February 18, 2026

Share: View original

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Lua Vulnerabilities CVE-2022-33099 and CVE-2022-28805 Published Two vulnerabilities in Lua have been published, affecting versions 5.4.4 and below. CVE-2022-33099 relates to an issue in the luaG_runerror component, while CVE-2022-28805 concerns a missing luaK_exp2anyregup call in lparser.c, leading to heap-based buffer overflows. Both vulnerabilities could potentially allow for exploitation in affected systems. 2 sources 43

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)

MITRE ATT&CK (1)