CVE-2022-28805: Fedoraproject Fedora

Critical severity, CVSS 9.1. EPSS: 3% chance of exploitation in the next 30 days.

singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.

Affected products

• Fedoraproject Fedora: version 35 only; version 36 only
• Lua Lua: from 5.4.0, before 5.4.5 (fixed in 5.4.5)

Published 2022-04-08. Last modified 2026-06-17.