{"id":"CVE-2026-24821","summary":"A heap-based buffer over-read that might affect a system that compiles untrusted Lua code in turanszkij/WickedEngine.","details":"Out-of-bounds Read vulnerability in turanszkij WickedEngine (WickedEngine/LUA modules). This vulnerability is associated with program files lparser.C.\n\nThis issue affects WickedEngine: through 0.71.727.","modified":"2026-08-12T15:31:49.420996Z","published":"2026-01-27T08:57:26.461Z","database_specific":{"cna_assigner":"GovTech CSG","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24821.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24821.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24821"},{"type":"FIX","url":"https://github.com/turanszkij/WickedEngine/pull/1095"},{"type":"PACKAGE","url":"https://github.com/turanszkij/WickedEngine"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/turanszkij/wickedengine","events":[{"introduced":"0"},{"fixed":"bc128fe6eb9e898ac4478a4446af9519087905f2"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"0.71.727"},{"fixed":"0.71.727"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["v0.71.711","v0.71.705","v0.71.672","v0.71.645","v0.71.624","v0.71.613","v0.71.585","v0.71.563","v0.71.532","v0.71.531","v0.71.501","v0.71.473","v0.71.446","v0.71.422","v0.71.392","v0.71.385","v0.71.354","v0.71.338","v0.71.312","v0.71.285","v0.71.272","v0.71.239","v0.71.219","v0.71.195","v0.71.190","v0.71.176","v0.71.143","v0.71.137","v0.71.124","v0.71.100","v0.71.47","v0.71.34","v0.70.18","v0.70.0","v0.60.84","v0.60.61","v0.60.4","v0.59.3","0.56.34","v0.51.18","v0.49.1","v0.48.0","v0.42.2","0.12.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24821.json","vanir_signatures_modified":"2026-08-12T15:31:49Z","vanir_signatures":[{"target":{"file":"WickedEngine/wiTerrain.cpp","function":"Terrain::Generation_Update"},"deprecated":false,"digest":{"function_hash":"309654032201599654221909799758471918271","length":19359},"id":"CVE-2026-24821-1343fc65","signature_type":"Function","signature_version":"v1","source":"https://github.com/turanszkij/wickedengine/commit/bc128fe6eb9e898ac4478a4446af9519087905f2"},{"deprecated":false,"digest":{"function_hash":"185636885287562368541487058784648836602","length":28232},"id":"CVE-2026-24821-166e2d2f","signature_type":"Function","signature_version":"v1","source":"https://github.com/turanszkij/wickedengine/commit/bc128fe6eb9e898ac4478a4446af9519087905f2","target":{"file":"Editor/RigidBodyWindow.cpp","function":"RigidBodyWindow::Create"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/turanszkij/wickedengine/commit/bc128fe6eb9e898ac4478a4446af9519087905f2","target":{"file":"WickedEngine/wiVersion.cpp"},"deprecated":false,"digest":{"line_hashes":["284475753498198766531528939439642775107","151128080216071124284569489605253292176","263759432749961469684104960444505277643","193487588931164758567423034670805892242"],"threshold":0.9},"id":"CVE-2026-24821-2a599204"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/turanszkij/wickedengine/commit/bc128fe6eb9e898ac4478a4446af9519087905f2","target":{"file":"WickedEngine/wiPrimitive.cpp"},"deprecated":false,"digest":{"line_hashes":["168738247791917407984636686398907257242","99043146508104877885953776373861554957","97964416017026685380477702033105701267","340075882229663180200370478043233198243"],"threshold":0.9},"id":"CVE-2026-24821-5db27c08"},{"deprecated":false,"digest":{"function_hash":"60022301980891556253018022811678250111","length":3451},"id":"CVE-2026-24821-6cef48ea","signature_type":"Function","signature_version":"v1","source":"https://github.com/turanszkij/wickedengine/commit/bc128fe6eb9e898ac4478a4446af9519087905f2","target":{"file":"WickedEngine/wiPhysics_Jolt.cpp","function":"CreateRigidBodyShape"}},{"digest":{"line_hashes":["107949174331447436392655174338702418286","276235926162210852299151322571130658818","73176718839933257858379644057998508492","183362712903399360417531878308307530574","240345436166431683561463365050262066491","334423731309823460358954575679087844007","82751030461921368571262318549859927900","322079262206661187563319524660965836998","17201218267680411213161509932753069631","292960243344357131796199607604418341879","183362712903399360417531878308307530574","218490320451371928271320218664007762646","257060408032053594075500131870747625019","66069568161283765837881317047167541935"],"threshold":0.9},"id":"CVE-2026-24821-9538acc1","signature_type":"Line","signature_version":"v1","source":"https://github.com/turanszkij/wickedengine/commit/bc128fe6eb9e898ac4478a4446af9519087905f2","target":{"file":"WickedEngine/wiTerrain.cpp"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/turanszkij/wickedengine/commit/bc128fe6eb9e898ac4478a4446af9519087905f2","target":{"file":"WickedEngine/wiPrimitive.h"},"deprecated":false,"digest":{"line_hashes":["159334054943096405490941272116971375429","81067273971205647318096915636789002696","295186802379606924905303114115962717067","193712913995471966489264471206951099323"],"threshold":0.9},"id":"CVE-2026-24821-97bc6fcb"},{"digest":{"line_hashes":["215626623960252251465092344733555487865","117404795895999593195822499389054997532","279730291014801113773016030851354978520","292272240562967920233828344266275302331"],"threshold":0.9},"id":"CVE-2026-24821-be7887e3","signature_type":"Line","signature_version":"v1","source":"https://github.com/turanszkij/wickedengine/commit/bc128fe6eb9e898ac4478a4446af9519087905f2","target":{"file":"WickedEngine/wiScene_Components.h"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/turanszkij/wickedengine/commit/bc128fe6eb9e898ac4478a4446af9519087905f2","target":{"file":"Editor/RigidBodyWindow.cpp"},"deprecated":false,"digest":{"line_hashes":["143885201864035743226960497096173475068","148830761009646817732126925913916993311","296115215098489481716937986393412362494","30134639327223095708786098711357077752"],"threshold":0.9},"id":"CVE-2026-24821-fd26a089","signature_type":"Line"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:H/SI:N/SA:H/S:N/AU:Y/R:U/V:D/RE:M/U:Amber"}]}