CVE-2021-44964

Use after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.0~5.4.3 allows attackers to perform Sandbox Escape via a crafted script file.

• CWE-416

• http://lua-users.org/lists/lua-l/2021-11/msg00186.htmlExploit, Mailing List, Technical Description, Vendor Advisory
• http://lua-users.org/lists/lua-l/2021-12/msg00007.htmlExploit, Mailing List, Vendor Advisory
• http://lua-users.org/lists/lua-l/2021-12/msg00015.htmlMailing List, Vendor Advisory
• http://lua-users.org/lists/lua-l/2021-12/msg00030.htmlMailing List, Vendor Advisory
• https://github.com/Lua-Project/lua-5.4.4-sandbox-escape-with-new-vulnerabilityExploit, Third Party Advisory
• http://lua-users.org/lists/lua-l/2021-11/msg00186.htmlExploit, Mailing List, Technical Description, Vendor Advisory
• http://lua-users.org/lists/lua-l/2021-12/msg00007.htmlExploit, Mailing List, Vendor Advisory
• http://lua-users.org/lists/lua-l/2021-12/msg00015.htmlMailing List, Vendor Advisory
• http://lua-users.org/lists/lua-l/2021-12/msg00030.htmlMailing List, Vendor Advisory
• https://github.com/Lua-Project/lua-5.4.4-sandbox-escape-with-new-vulnerabilityExploit, Third Party Advisory

Published

Mar 14, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-44954In QVIS NVR DVR before 2021-12-13, an attacker can escalate …7.8
• CVE-2021-44956Two Heap based buffer overflow vulnerabilities exist in ffjp…6.5
• CVE-2021-44957Global buffer overflow vulnerability exist in ffjpeg through…6.5
• CVE-2021-44960In SVGPP SVG++ library 1.3.0, the XMLDocument::getRoot funct…6.5
• CVE-2021-44961A memory leakage flaw exists in the class PerimeterGenerator…5.5
• CVE-2021-44962An out-of-bounds read vulnerability exists in the GCode::ext…5.5
• CVE-2021-44965Directory traversal vulnerability in /admin/includes/* direc…7.5
• CVE-2021-44966SQL injection bypass authentication vulnerability in PHPGURU…9.8
• CVE-2021-44967A Remote Code Execution (RCE) vulnerabilty exists in LimeSur…8.8
• CVE-2021-44968A Use after Free vulnerability exists in IOBit Advanced Syst…7.8
• CVE-2021-44969Taocms v3.0.2 was discovered to contain a cross-site scripti…4.8
• CVE-2021-44970MiniCMS v1.11 was discovered to contain a cross-site scripti…5.4