CVE-2022-28805 in Lua
Summary
by MITRE • 04/08/2022
singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/20/2026
The vulnerability identified as CVE-2022-28805 resides within the Lua programming language implementation, specifically in the lparser.c file where the singlevar function operates. This flaw affects Lua versions 5.4.0 through 5.4.3, creating a critical security risk when systems process untrusted Lua code through the compilation phase. The issue manifests as a heap-based buffer over-read condition that can potentially compromise system integrity and stability.
The technical root cause stems from the absence of a crucial luaK_exp2anyregup function call within the singlevar implementation. This function is responsible for properly managing register allocation and ensuring that expressions are correctly positioned within the virtual machine's register space. Without this call, the parser fails to adequately handle variable references, leading to improper memory management during code compilation. The missing function call creates a scenario where the compiler attempts to read beyond allocated memory boundaries, resulting in the buffer over-read condition.
When untrusted Lua code is compiled on a vulnerable system, attackers can exploit this flaw by crafting malicious code that triggers the specific parsing path containing the missing function call. The heap-based nature of the vulnerability means that the over-read occurs within the heap memory region, potentially allowing for information disclosure, denial of service, or in more severe cases, arbitrary code execution depending on the system configuration and memory layout. This vulnerability directly impacts systems that serve as Lua code compilation servers or those that process user-provided Lua scripts.
The operational impact of CVE-2022-28805 extends beyond simple memory corruption, as it represents a fundamental flaw in the Lua compiler's handling of variable expressions. Systems utilizing Lua for scripting, embedded applications, or as a configuration language are at risk when processing untrusted input. The vulnerability aligns with CWE-125, which describes out-of-bounds read conditions, and can be categorized under ATT&CK technique T1059.007 for scripting languages. Organizations running Lua-based applications should consider this vulnerability as a high-priority concern, particularly those with internet-facing services or systems that process external code submissions.
Mitigation strategies should focus on immediate patching of Lua implementations to versions 5.4.4 or later where the fix has been implemented. System administrators should also consider implementing additional code validation and sandboxing measures when processing untrusted Lua code. The fix involves properly inserting the missing luaK_exp2anyregup call to ensure correct register management and prevent the buffer over-read condition from occurring during code compilation. Organizations should conduct thorough vulnerability assessments to identify systems running vulnerable Lua versions and prioritize remediation efforts accordingly.