CVE-2024-25176 LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Identified in LuaJIT and OpenRusty Vulnerabilities Two critical vulnerabilities have been identified in LuaJIT and OpenRusty, affecting versions through 2.1 and prior to specific updates. CVE-2024-25178 involves an out-of-bounds read in the stack-overflow handler, while CVE-2024-25176 pertains to a stack-buffer-overflow in string formatting functions. Both vulnerabilities were published on July 7, 2025. 2 sources 34