CVE-2021-45985: High severity microsoft windows server 2025 vulnerability
In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read.
Other sources
Mitre: CVE-2021-45985 Erroneous finalizer call in Lua leads to a heap-based buffer over-read
— Microsoft
This CVE was assigned by Mitre. Some Microsoft products consume Lau open-source software. The purpose of this document is to attest to the fact that the products listed in the Security Updates table have been updated to protect against this vulnerability.
— Microsoft
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-45985?
CVE-2021-45985 is a vulnerability in Lua 5.4.3 that causes an erroneous finalizer to be called during a tail call, leading to a heap-based buffer over-read.
What is the severity of CVE-2021-45985?
The severity of CVE-2021-45985 is high, with a severity value of 7.5.
How does CVE-2021-45985 impact Lua 5.4.3?
CVE-2021-45985 can cause a heap-based buffer over-read in Lua 5.4.3 due to an erroneous finalizer called during a tail call.
How can I fix CVE-2021-45985?
To fix CVE-2021-45985, update Lua to version 5.4.4 or later, which includes a patch for the vulnerability.
Where can I find more information about CVE-2021-45985?
You can find more information about CVE-2021-45985 on the Lua mailing list, Lua GitHub repository, and Lua bug tracker.