Skip to main content

Ubuntu CVE-2024-25176

| EUVDEUVD-2024-22512 CRITICAL
Stack-based Buffer Overflow (CWE-121)
2025-07-07 cve@mitre.org
Buffer Overflow Stack Overflow Ubuntu Debian Luajit Red Hat Suse
Critical
Disputed · 9.8 NVD
Share

Severity by source

Sources disagree (Low–Critical)
NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Ubuntu
MEDIUM
qualitative
SUSE
CRITICAL
qualitative
Red Hat
1.9 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
EUVD ID Assigned
Mar 16, 2026 - 03:37 euvd
EUVD-2024-22512
Analysis Generated
Mar 16, 2026 - 03:37 vuln.today
Patch released
Mar 16, 2026 - 03:37 nvd
Patch available
PoC Detected
Nov 03, 2025 - 19:15 vuln.today
Public exploit code
CVE Published
Jul 07, 2025 - 17:15 nvd
CRITICAL 9.8

DescriptionCVE.org

LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c.

Analysis

LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c.

Technical ContextAI

A buffer overflow occurs when data written to a buffer exceeds its allocated size, potentially overwriting adjacent memory and corrupting program state. This vulnerability is classified as Stack-based Buffer Overflow (CWE-121).

RemediationAI

A vendor patch is available — apply it immediately. Use memory-safe languages or bounds-checked functions. Enable ASLR, DEP/NX, and stack canaries. Apply vendor patches promptly.

More in Luajit

View all
CVE-2024-25178 CRITICAL POC
9.1 Jul 07

LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an out-of-bounds read in the stack-overflow handler i
CVE-2024-25177 HIGH POC
7.5 Jul 07

LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an unsinking of IR_FSTORE for NULL metatable, which l
CVE-2020-24372 HIGH POC
7.5 Aug 17

LuaJIT through 2.1.0-beta3 has an out-of-bounds read in lj_err_run in lj_err.c. Rated high severity (CVSS 7.5), this vul
CVE-2020-15890 HIGH POC
7.5 Jul 21

LuaJit through 2.1.0-beta3 has an out-of-bounds read because __gc handler frame traversal is mishandled. Rated high seve
CVE-2019-19391 CRITICAL
9.1 Nov 29

In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, debug.getinfo has a type confusion issue th

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.0
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8
CVE-2010-3333 HIGH POC
7.8

Vendor StatusVendor

Ubuntu

Priority: Medium
luajit
Release Status Version
jammy needs-triage -
noble needs-triage -
trusty needs-triage -
xenial needs-triage -
bionic needs-triage -
focal needs-triage -
upstream needs-triage -
plucky ignored end of life, was needs-triage
oracular ignored end of life, was needs-triage
questing needs-triage -

Debian

luajit
Release Status Fixed Version Urgency
bullseye fixed 2.1.0~beta3+dfsg-5.3+deb11u1 -
bullseye (security) fixed 2.1.0~beta3+dfsg-5.3+deb11u1 -
bookworm fixed 2.1.0~beta3+git20220320+dfsg-4.1+deb12u1 -
trixie fixed 2.1.0+openresty20250117-2 -
forky, sid fixed 2.1.0+openresty20251030-1 -
(unstable) fixed 2.1.0+openresty20240314-1 -
DLA-4283-1

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise High Performance Computing 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
openSUSE Leap 15.6 Fixed

Share

CVE-2024-25176 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy