CVE-2020-24370

MEDIUM

Lua 5.4.0 - Integer Underflow via getlocal/setlocal Debug Interface

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2020-24370. PoCs published by RenukaSelvar.

AI-analyzed exploit summary This repository contains the source code for Lua 5.3.5, specifically highlighting the patches applied after CVE-2020-24370. The code includes modifications to core Lua files such as lapi.c, lauxlib.c, and others, but does not contain an exploit PoC or offensive techniques.

Description

ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).

Exploits (2)

nomisec WRITEUP
by RenukaSelvar · poc
https://github.com/RenukaSelvar/lua_CVE-2020-24370_AfterPatch

This repository contains the source code for Lua 5.3.5, specifically highlighting the patches applied after CVE-2020-24370. The code includes modifications to core Lua files such as lapi.c, lauxlib.c, and others, but does not contain an exploit PoC or offensive techniques.

Classification
Writeup 90%
Attack Type
Other
Complexity
Moderate
Reliability
Theoretical
Target: Lua 5.3.5
No auth needed
Prerequisites: Access to Lua 5.3.5 source code
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by RenukaSelvar · poc
https://github.com/RenukaSelvar/lua_CVE-2020-24370

This repository contains a proof-of-concept exploit for CVE-2020-24370, a vulnerability in Lua 5.3.5. The exploit targets a stack overflow issue in the Lua interpreter, allowing for potential remote code execution (RCE) or denial of service (DoS).

Classification
Working Poc 90%
Attack Type
Rce | Dos
Complexity
Moderate
Reliability
Reliable
Target: Lua 5.3.5
No auth needed
Prerequisites: Access to a system running Lua 5.3.5 · Ability to execute arbitrary Lua code
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (6)

Core 6

Scores

CVSS v3 5.3
EPSS 0.0386
EPSS Percentile 88.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Details

CWE
CWE-191
Status published
Products (14)
debian/debian_linux 9.0
fedoraproject/fedora 31
fedoraproject/fedora 32
lua/lua 5.2.0 (3 CPE variants)
lua/lua 5.2.1
lua/lua 5.2.2
lua/lua 5.2.3
lua/lua 5.3.0 (3 CPE variants)
lua/lua 5.3.1
lua/lua 5.3.2
... and 4 more
Published Aug 17, 2020
Tracked Since Feb 18, 2026