CVE-2024-25178 LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an out-of-bounds read in the stack-overflow handler in lj_state.c.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Identified in LuaJIT and OpenRusty Vulnerabilities Two critical vulnerabilities have been identified in LuaJIT and OpenRusty, affecting versions through 2.1 and prior to specific updates. CVE-2024-25178 involves an out-of-bounds read in the stack-overflow handler, while CVE-2024-25176 pertains to a stack-buffer-overflow in string formatting functions. Both vulnerabilities were published on July 7, 2025. 2 sources 34