CVE-2024-25176

LuaJIT through 2.1 has a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c.

9.8 CriticalFix available

LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.60%Up 0.6 points since Jul 8, 2025

What each source reports

CVE List Score used 9.8

LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c.

Record: CVE-2024-25176
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-121
Updated: 2026-11-02

EUVDEUVD-2024-22512 9.8

LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c.

Record: EUVD-2024-22512
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-xvfg-m24j-r4pm 9.8

LuaJIT through 2.1 has a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c.

LuaJIT through 2.1 has a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c.

Record: GHSA-xvfg-m24j-r4pm
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-121
Updated: 2026-11-02

NVD 9.8

LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c.

Record: CVE-2024-25176
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-121
Updated: 2026-11-02

OSVALPINE-CVE-2024-25176 9.8

LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c.

Record: ALPINE-CVE-2024-25176
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVBELL-CVE-2024-25176 9.8

Record: BELL-CVE-2024-25176
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 10 moreShow less

OSV 9.8

LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c.

Record: CVE-2024-25176
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-04

OSVDEBIAN-CVE-2024-25176 9.8

LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c.

Record: DEBIAN-CVE-2024-25176
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-25176 9.8

LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c.

Record: UBUNTU-CVE-2024-25176
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVAZL-65370 No score

CVE-2024-25176 affecting package luajit for versions less than 2.1.0-27

LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c.

Record: AZL-65370
Updated: 2026-11-02

OSVAZL-65394 No score

CVE-2024-25176 affecting package sysbench for versions less than 1.0.20-3

LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c.

Record: AZL-65394
Updated: 2026-11-02

OSVAZL-65427 No score

CVE-2024-25176 affecting package sysbench for versions less than 1.0.20-6

LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c.

Record: AZL-65427
Updated: 2026-11-05

OSVMGASA-2026-0225 No score

Updated luajit packages fix security vulnerabilities

In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, debug.getinfo has a type confusion issue that leads to arbitrary memory write or read operations, because certain cases involving valid stack levels and > options are mishandled. (CVE-2019-19391) LuaJIT through 2.1.0-beta3 has an out-of-bounds read in lj_err_run in lj_err.c. (CVE-2020-24372) LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c. (CVE-2024-25176) LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an unsinking of IR_FSTORE for NULL metatable, which leads to Denial of Service (DoS). (CVE-2024-25177) LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an out-of-bounds read in the stack-overflow handler in lj_state.c. (CVE-2024-25178)

Record: MGASA-2026-0225
Updated: 2026-11-02

OSVSUSE-SU-2025:02886-1 No score

Security update for lua51-luajit

This update for lua51-luajit fixes the following issues:

CVE-2024-25176: Fixed stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c (bsc#1246077)
CVE-2024-25177: Fixed unsinking of IR_FSTORE for NULL metatable (bsc#1246078)
CVE-2024-25178: Fixed ut-of-bounds read in the stack-overflow handler in lj_state.c (bsc#1246079)

Record: SUSE-SU-2025:02886-1
Updated: 2026-11-02

OSVSUSE-SU-2025:03378-1 No score

Security update for luajit

This update for luajit fixes the following issues:

CVE-2024-25176: Fixed stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c (bsc#1246077)
CVE-2024-25177: Fixed unsinking of IR_FSTORE for NULL metatable (bsc#1246078)
CVE-2024-25178: Fixed out-of-bounds read in the stack-overflow handler in lj_state.c (bsc#1246079)

Record: SUSE-SU-2025:03378-1
Updated: 2026-11-02

OSVUSN-8544-1 No score

luajit vulnerabilities

It was discovered that LuaJIT incorrectly handled certain inputs. An attacker could possibly use these issues to cause a crash, resulting in a denial of service, or execute arbitrary code.

Record: USN-8544-1
Updated: 2026-11-02

Affected products

luajit

Affected packages

Affected packages
Package	Affected	Fixed
`luajit` Alpine:v3.19	before 2.1_p20240815-r1	2.1_p20240815-r1
`luajit` Alpine:v3.20	before 2.1_p20240815-r1	2.1_p20240815-r1
`luajit` Alpine:v3.21	before 2.1_p20240815-r1	2.1_p20240815-r1
`luajit` Alpine:v3.22	before 2.1_p20240815-r1	2.1_p20240815-r1
`luajit` Alpine:v3.23	before 2.1_p20240815-r1	2.1_p20240815-r1
`luajit` Alpine:v3.24	before 2.1_p20240815-r1	2.1_p20240815-r1
`luajit` Azure Linux:2	before 2.1.0-27	2.1.0-27
`sysbench` Azure Linux:2	before 1.0.20-3	1.0.20-3
`sysbench` Azure Linux:3	before 1.0.20-6	1.0.20-6
`luajit` Alpaquita:23	2.1_p20210510-r3 up to 2.1_p20210510-r4	2.1_p20210510-r4

Show 25 moreShow less

Affected packages
Package	Affected	Fixed
`luajit` Alpaquita:stream	2.1_p20210510-r3 up to 2.1_p20240314-r0	2.1_p20240314-r0
`luajit` Debian:12	before 2.1.0~beta3+git20220320+dfsg-4.1+deb12u1, plus listed versions 2.1.0~beta3+git20220320+dfsg-4.1	2.1.0~beta3+git20220320+dfsg-4.1+deb12u1
`luajit` Debian:13	before 2.1.0+openresty20240314-1	2.1.0+openresty20240314-1
`luajit` Debian:14	before 2.1.0+openresty20240314-1	2.1.0+openresty20240314-1
`luajit` Debian:11 From an advisory covering 6 CVEs	before 2.1.0~beta3+dfsg-5.3+deb11u1, plus listed versions 2.1.0~beta3+dfsg-5.3	2.1.0~beta3+dfsg-5.3+deb11u1
`luajit` Mageia:9 From an advisory covering 5 CVEs	before 2.1.0-0.beta3.10.1.mga9	2.1.0-0.beta3.10.1.mga9
`lua51-luajit` openSUSE:Leap 15.6 From an advisory covering 3 CVEs	before 2.1.0~beta2-150000.3.3.1	2.1.0~beta2-150000.3.3.1
`luajit` SUSE:Linux Enterprise Module for Basesystem 15 SP6 From an advisory covering 3 CVEs	before 2.1.0~beta3+git.1624618403.e9577376-150400.4.5.1	2.1.0~beta3+git.1624618403.e9577376-150400.4.5.1
`luajit` SUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 3 CVEs	before 2.1.0~beta3+git.1624618403.e9577376-150400.4.5.1	2.1.0~beta3+git.1624618403.e9577376-150400.4.5.1
`luajit` SUSE:Linux Enterprise Module for Package Hub 15 SP6 From an advisory covering 3 CVEs	before 2.1.0~beta3+git.1624618403.e9577376-150400.4.5.1	2.1.0~beta3+git.1624618403.e9577376-150400.4.5.1
`luajit` SUSE:Linux Enterprise Module for Package Hub 15 SP7 From an advisory covering 3 CVEs	before 2.1.0~beta3+git.1624618403.e9577376-150400.4.5.1	2.1.0~beta3+git.1624618403.e9577376-150400.4.5.1
`luajit` openSUSE:Leap 15.6 From an advisory covering 3 CVEs	before 2.1.0~beta3+git.1624618403.e9577376-150400.4.5.1	2.1.0~beta3+git.1624618403.e9577376-150400.4.5.1
`luajit` Ubuntu:Pro:18.04:LTS	before 2.1.0~beta3+dfsg-5.1ubuntu0.18.04.1~esm1, plus listed versions 2.0.4+dfsg-12.1.0~beta3+dfsg-52.1.0~beta3+dfsg-5.1	2.1.0~beta3+dfsg-5.1ubuntu0.18.04.1~esm1
`luajit` Ubuntu:Pro:20.04:LTS	before 2.1.0~beta3+dfsg-5.1ubuntu0.20.04.1~esm1, plus listed versions 2.1.0~beta3+dfsg-5.12.1.0~beta3+dfsg-5.1build1	2.1.0~beta3+dfsg-5.1ubuntu0.20.04.1~esm1
`luajit` Ubuntu:22.04:LTS	before 2.1.0~beta3+dfsg-6ubuntu0.1, plus listed versions 2.1.0~beta3+dfsg-6	2.1.0~beta3+dfsg-6ubuntu0.1
`luajit` Ubuntu:24.04:LTS	before 2.1.0+git20231223.c525bcb+dfsg-1ubuntu0.1, plus listed versions 2.1.0~beta3+git20220320+dfsg-4.12.1.0+git20231223.c525bcb+dfsg-1~build12.1.0+git20231223.c525bcb+dfsg-1	2.1.0+git20231223.c525bcb+dfsg-1ubuntu0.1
`luajit` Ubuntu:25.10	All versions, plus listed versions 2.1.0+openresty20250117-22.1.0+openresty20250117-2ubuntu1	None known
`luajit` Ubuntu:26.10	All versions, plus listed versions 2.1.0+openresty20251030-1	None known
`luajit` Ubuntu:26.04:LTS	All versions, plus listed versions 2.1.0+openresty20250117-2ubuntu12.1.0+openresty20251030-1	None known
`luajit` Ubuntu:Pro:14.04:LTS From an advisory covering 3 CVEs	before 2.0.2+dfsg-1ubuntu0.1~esm1, plus listed versions 2.0.2+dfsg-1	2.0.2+dfsg-1ubuntu0.1~esm1
`luajit` Ubuntu:Pro:16.04:LTS From an advisory covering 3 CVEs	before 2.0.4+dfsg-1+deb9u1ubuntu0.1~esm1, plus listed versions 2.0.4+dfsg-12.0.4+dfsg-1+deb9u1build0.16.04.1	2.0.4+dfsg-1+deb9u1ubuntu0.1~esm1
`luajit` Ubuntu:Pro:18.04:LTS From an advisory covering 3 CVEs	before 2.1.0~beta3+dfsg-5.1ubuntu0.18.04.1~esm1, plus listed versions 2.0.4+dfsg-12.1.0~beta3+dfsg-52.1.0~beta3+dfsg-5.1	2.1.0~beta3+dfsg-5.1ubuntu0.18.04.1~esm1
`luajit` Ubuntu:Pro:20.04:LTS From an advisory covering 3 CVEs	before 2.1.0~beta3+dfsg-5.1ubuntu0.20.04.1~esm1, plus listed versions 2.1.0~beta3+dfsg-5.12.1.0~beta3+dfsg-5.1build1	2.1.0~beta3+dfsg-5.1ubuntu0.20.04.1~esm1
`luajit` Ubuntu:22.04:LTS From an advisory covering 3 CVEs	before 2.1.0~beta3+dfsg-6ubuntu0.1, plus listed versions 2.1.0~beta3+dfsg-6	2.1.0~beta3+dfsg-6ubuntu0.1
`luajit` Ubuntu:24.04:LTS From an advisory covering 3 CVEs	before 2.1.0+git20231223.c525bcb+dfsg-1ubuntu0.1, plus listed versions 2.1.0~beta3+git20220320+dfsg-4.12.1.0+git20231223.c525bcb+dfsg-1~build12.1.0+git20231223.c525bcb+dfsg-1	2.1.0+git20231223.c525bcb+dfsg-1ubuntu0.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected	OSV
Nov 4, 2026	facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-25176 is a critical vulnerability (CVSS 9.8) in Luajit, published July 7, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 48th percentile. Fixed in luajit 2.1_p20240815-r1.

References

Show 21 moreShow less