CVE-2026-24820 - Vulnerability Details - OpenCVE

Out-of-bounds Read vulnerability in turanszkij WickedEngine (WickedEngine/LUA modules). This vulnerability is associated with program files ldebug.C. This issue affects WickedEngine: before 0.71.705.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact Low

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Turanszkij	Wickedengine

No data.

No data.

References

Link	Providers
https://github.com/turanszkij/WickedEngine/pull/1054

History

Tue, 27 Jan 2026 20:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Turanszkij Turanszkij wickedengine
Vendors & Products		Turanszkij Turanszkij wickedengine

Tue, 27 Jan 2026 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 27 Jan 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		Out-of-bounds Read vulnerability in turanszkij WickedEngine (WickedEngine/LUA modules). This vulnerability is associated with program files ldebug.C. This issue affects WickedEngine: before 0.71.705.
Title		A stack overflow vulnerability in turanszkij/WickedEngine
Weaknesses		CWE-125
References		https://github.com/turanszkij/WickedEngine/pull/1054
Metrics		cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/S:N/AU:Y/R:U/V:C/RE:L/U:Amber'}`

MITRE

Status: PUBLISHED

Assigner: GovTech CSG

Published: 2026-01-27T08:56:34.369Z

Updated: 2026-01-27T17:00:59.226Z

Reserved: 2026-01-27T08:48:56.893Z

Link: CVE-2026-24820

Vulnrichment

Updated: 2026-01-27T17:00:55.539Z

NVD

Status : Awaiting Analysis

Published: 2026-01-27T09:15:52.663

Modified: 2026-01-27T14:59:34.073

Link: CVE-2026-24820

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24820", "assignerOrgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd", "state": "PUBLISHED", "assignerShortName": "GovTech CSG", "dateReserved": "2026-01-27T08:48:56.893Z", "datePublished": "2026-01-27T08:56:34.369Z", "dateUpdated": "2026-01-27T17:00:59.226Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://github.com/turanszkij/WickedEngine", "defaultStatus": "affected", "modules": ["WickedEngine/LUA"], "product": "WickedEngine", "programFiles": ["ldebug.c"], "vendor": "turanszkij", "versions": [{"lessThan": "0.71.705", "status": "affected", "version": "0", "versionType": "git"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "TITAN Team (titancaproject@gmail.com)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Out-of-bounds Read vulnerability in turanszkij WickedEngine (WickedEngine/LUA modules).<p> This vulnerability is associated with program files <tt>ldebug.C</tt>.</p><p>This issue affects WickedEngine: before 0.71.705.</p>"}], "value": "Out-of-bounds Read vulnerability in turanszkij WickedEngine (WickedEngine/LUA modules). This vulnerability is associated with program files ldebug.C.\n\nThis issue affects WickedEngine: before 0.71.705."}], "metrics": [{"cvssV4_0": {"Automatable": "YES", "Recovery": "USER", "Safety": "NEGLIGIBLE", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 5.1, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "AMBER", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/S:N/AU:Y/R:U/V:C/RE:L/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "LOW"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd", "shortName": "GovTech CSG", "dateUpdated": "2026-01-27T08:56:34.369Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/turanszkij/WickedEngine/pull/1054"}], "source": {"discovery": "UNKNOWN"}, "title": "A stack overflow vulnerability in turanszkij/WickedEngine", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-27T17:00:49.764145Z", "id": "CVE-2026-24820", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T17:00:59.226Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24820", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-27T17:00:49.764145Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T17:00:55.539Z"}}], "cna": {"title": "A stack overflow vulnerability in turanszkij/WickedEngine", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "TITAN Team (titancaproject@gmail.com)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NEGLIGIBLE", "version": "4.0", "Recovery": "USER", "baseScore": 5.1, "Automatable": "YES", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/S:N/AU:Y/R:U/V:C/RE:L/U:Amber", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "AMBER", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "turanszkij", "modules": ["WickedEngine/LUA"], "product": "WickedEngine", "versions": [{"status": "affected", "version": "0", "lessThan": "0.71.705", "versionType": "git"}], "programFiles": ["ldebug.c"], "collectionURL": "https://github.com/turanszkij/WickedEngine", "defaultStatus": "affected"}], "references": [{"url": "https://github.com/turanszkij/WickedEngine/pull/1054", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Out-of-bounds Read vulnerability in turanszkij WickedEngine (WickedEngine/LUA modules). This vulnerability is associated with program files ldebug.C.\n\nThis issue affects WickedEngine: before 0.71.705.", "supportingMedia": [{"type": "text/html", "value": "Out-of-bounds Read vulnerability in turanszkij WickedEngine (WickedEngine/LUA modules).<p> This vulnerability is associated with program files <tt>ldebug.C</tt>.</p><p>This issue affects WickedEngine: before 0.71.705.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd", "shortName": "GovTech CSG", "dateUpdated": "2026-01-27T08:56:34.369Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24820", "state": "PUBLISHED", "dateUpdated": "2026-01-27T17:00:59.226Z", "dateReserved": "2026-01-27T08:48:56.893Z", "assignerOrgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd", "datePublished": "2026-01-27T08:56:34.369Z", "assignerShortName": "GovTech CSG"}, "dataVersion": "5.2"}