Critical · 9.3 CVE-2026-24821 EUVD-2026-4802GHSA-mfmq-rvc6-qmj6

A heap-based buffer over-read that might affect a system that compiles untrusted Lua code in turanszkij/WickedEngine.

Published Jan 27, 2026 · Updated Jan 27, 2026 · Assigned by GovTech CSG

Vendor: turanszkij Product: WickedEngine

Description

Out-of-bounds Read vulnerability in turanszkij WickedEngine (WickedEngine/LUA modules). This vulnerability is associated with program files lparser.C.

This issue affects WickedEngine: through 0.71.727.

Affected products

Vendor	Product	Affected	Fixed
turanszkij	WickedEngine	—	—

References

https://github.com/turanszkij/WickedEngine/pull/1095 patch