PT-2026-4896 · Turanszkij · Wickedengine

Titan Team · CVE-2026-24821 · Published 2026-01-27 · Updated 2026-03-05

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:H/SI:N/SA:H/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

Name of the Vulnerable Software and Affected Versions turanszkij WickedEngine versions through 0.71.727

Description An out-of-bounds read issue exists in turanszkij WickedEngine, specifically within the LUA modules and associated file lparser.C. The issue is a heap-based buffer over-read that can occur when compiling untrusted Lua code. This allows attackers to potentially bypass memory boundaries.

Recommendations Versions prior to 0.71.728 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-24821

Affected Products

Wickedengine

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24821.json · Exploit
• https://github.com/turanszkij/WickedEngine/pull/1095 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-24821 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24821 · Vendor Advisory
• https://github.com/turanszkij/WickedEngine · Note
• https://twitter.com/0dayPublishing/status/2016076593169326569 · Twitter Post
• https://twitter.com/CVEnew/status/2016081233155883278 · Twitter Post
• https://t.me/CVEtracker/43047 · Telegram Post
• https://t.me/msrcreports/3325 · Telegram Post