CVE-2026-24809: 
Memcached vulnerability analysis and mitigation

CVE-2026-24809 is a heap-buffer overflow vulnerability in praydog/REFramework, a modding framework for games built on RE Engine. The flaw originates in the luaG_runerror function within dependencies/lua/src/ldebug.c, where a recursive error condition triggers an out-of-bounds write. It affects REFramework versions before 1.5.5 and was published on January 27, 2026. The vulnerability carries a CVSS v4.0 base score of 6.9 (Medium), assigned by GovTech CSG (Feedly, GitHub PR).

The root cause is an out-of-bounds write (CWE-787) in the Lua runtime's error-handling path. REFramework bundles a copy of the Lua interpreter that did not receive the upstream security patch (lua/lua commit 42d4058) addressing stack exhaustion during recursive error handling in luaG_runerror(). When a recursive error occurs, the function can overflow a heap buffer due to insufficient stack space management. The fix was originally tracked upstream as CVE-2022-33099 in the Lua project and was ported to REFramework via pull request #1320, merged April 21, 2025 (GitHub PR).

Successful exploitation can cause a denial-of-service condition by crashing the host application (high availability impact to the vulnerable component). Because the attack vector is local and the vulnerability resides in a game modding framework, the primary risk is application instability or crash when a malicious or malformed Lua script triggers recursive error handling. Confidentiality and integrity impacts are assessed as none at the vulnerable component level, though a low subsidiary availability impact is noted (Feedly).

1. Identify target: Locate a system running REFramework version prior to 1.5.5 with Lua scripting enabled.
2. Craft malicious Lua script: Write a Lua script that triggers a recursive error condition — for example, a function that raises an error within an error handler, causing luaG_runerror to be called recursively.
3. Deploy script: Place the crafted Lua script in the REFramework scripts directory or inject it through any available script-loading interface.
4. Trigger execution: Launch the game with REFramework loaded so the malicious script is executed, causing the recursive error path in luaG_runerror to overflow the heap buffer.
5. Achieve denial of service: The heap-buffer overflow causes the host game process to crash, resulting in a denial-of-service condition (GitHub PR).

• File System: Presence of unexpected or unfamiliar .lua script files in the REFramework scripts directory that contain recursive error-handling patterns.
• Process: Abnormal crash or termination of the game process (e.g., access violation or heap corruption crash dump) associated with REFramework's Lua runtime.
• Logs: REFramework or game crash logs referencing ldebug.c, luaG_runerror, or stack overflow/heap corruption errors.

Users should upgrade REFramework to version 1.5.5 or later, which incorporates the fix from pull request #1320 (merged April 21, 2025). The patch applies the same stack-space-saving change from upstream Lua commit 42d4058 that resolved CVE-2022-33099. As a workaround, avoid loading untrusted or unknown Lua scripts in REFramework until the update is applied (GitHub PR).

The vulnerability was reported by contributor npt-1707, who identified that REFramework's bundled Lua copy had not received the upstream CVE-2022-33099 patch and submitted a fix via GitHub pull request. Project owner praydog confirmed the issue and merged the fix, noting that the Lua version itself would not be upgraded to avoid forcing plugin authors to update their own Lua versions. Community reaction has been minimal given the niche scope of the affected software (GitHub PR).