CVE-2021-45985: In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read.

Security readout for executives and security teams

Lua 5.4.3 has a memory-safety flaw where finalization during a tail call can read beyond heap boundaries. The documented impact is availability, not data theft or tampering. Organizations should prioritize systems that embed Lua in externally reachable services or process untrusted Lua-influenced input. Exposure is most likely in applications, appliances, or services embedding Lua 5.4.3. The source bundle provides no product CPEs, so vulnerability managers must inventory direct and bundled Lua runtimes rather than rely on product matching alone. Treat as high priority where Lua 5.4.3 is embedded in internet-facing or automation-heavy services. The known impact is service disruption, so remediation should focus on availability-critical systems first. Mitigation focus: Inventory direct and embedded Lua 5.4.3 runtimes.; Apply the official Lua fix or downstream vendor update.; Prioritize externally reachable services using Lua 5.4.3..

Prepared

May 24, 2026, 02:09 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.