MGASA-2026-0573
Updated minetest package fixes security vulnerabilities
The client mesh loaders suffer from memory safety issues including unbounded out-of-bounds heap writes and use-after-free, which might be used to obtain arbitrary code execution on the client. (High) Installing content from an untrusted ContentDB instance can result in remote code execution. (Moderate) Singleplayer: Lua sandbox escape from mod (Critical)
What each source reports
OSV No score
Updated minetest package fixes security vulnerabilities
The client mesh loaders suffer from memory safety issues including unbounded out-of-bounds heap writes and use-after-free, which might be used to obtain arbitrary code execution on the client. (High) Installing content from an untrusted ContentDB instance can result in remote code execution. (Moderate) Singleplayer: Lua sandbox escape from mod (Critical)
- Record
MGASA-2026-0573- Updated
- 2026-11-04
Affected packages
| Package | Affected | Fixed |
|---|---|---|
minetestMageia:10 |
before 5.18.0-1.1.mga10 | 5.18.0-1.1.mga10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
MGASA-2026-0573 is a vulnerability with no CVSS score yet in minetest, published November 4, 2026. No source lists public exploit code. Fixed in minetest 5.18.0-1.1.mga10.