← All advisories

Critical severity9.8NVD Advisory· Published Jul 21, 2020· Updated Jun 17, 2026

CVE-2020-15889

CVE-2020-15889

Description

Lua 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list members.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4

Lua/Lua2 versions
cpe:2.3:a:lua:lua:5.4.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:lua:lua:5.4.0:*:*:*:*:*:*:*
- (no CPE)range: =5.4.0
Lua/Luadescription
osv-coords
pkg:bitnami/lua
Range: >= 5.4.0, < 5.4.1

Patches

Vulnerability mechanics

References

3

github.com/lua/lua/commit/127e7a6c8942b362aa3c6627f44d660a4fb75312nvdPatchThird Party Advisory
lua-users.org/lists/lua-l/2020-07/msg00078.htmlnvdExploitMailing ListThird Party Advisory
lua-users.org/lists/lua-l/2020-12/msg00157.htmlnvdMailing ListThird Party Advisory

News mentions

0

No linked articles in our index yet.