CVE-2021-44964: Lua

Medium severity, CVSS 6.3. EPSS: 1% chance of exploitation in the next 30 days.

Use after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.0~5.4.3 allows attackers to perform Sandbox Escape via a crafted script file.

Affected products

• Lua Lua: from 5.4.0, up to and including 5.4.3

Published 2022-03-14. Last modified 2026-06-17.