LuaJIT: stack-buffer overflow in LuaJIT lj_strfmt_wfnum (CVE-2024-25176) #shorts

Summary

Today we’re discussing CVE-2024-25176, a critical stack-buffer-overflow vulnerability in LuaJIT through version 2.1. This flaw allows an attacker to overflow a fixed-size buffer on the stack when formatting numeric values and could lead to code execution or denial of service. Fedora has already issued security advisories and released patches for Fedora 41 and 42 to address the issue.

Product details

LuaJIT is a high-performance Just-In-Time compiler for the Lua scripting language, used in gaming engines, embedded systems, web servers, and other performance-sensitive applications. Versions up to and including 2.1 are affected, and many Linux distributions and software projects bundle LuaJIT by default, making this a broadly impacting issue for both developers and end users.

Vulnerability type summary

The vulnerability is a classic stack-based buffer overflow in the function lj_strfmt_wfnum within lj_strfmt_num.c. It occurs when LuaJIT formats certain numeric values—specifically wide floating-point numbers—into a statically allocated buffer without proper bounds checking.

Details of the vulnerability

Inside lj_strfmt_wfnum, LuaJIT reserves a fixed-length buffer on the stack and then writes formatted numeric data into it. By crafting a specially formed format string or numeric value, an attacker can force the function to write beyond the buffer’s boundary. This overflow can overwrite return addresses or other stack metadata, potentially allowing arbitrary code execution in the context of the running process or causing a crash. The flaw was reported upstream and tracked as CVE-2024-25176; Fedora 41 and 42 users should apply the provided updates immediately.

Conclusion

CVE-2024-25176 underscores the importance of rigorous input validation and bounds checking in low-level formatting code. All users and maintainers of LuaJIT should upgrade to the patched package as soon as possible. If you build LuaJIT from source, apply the upstream fix or move to a released version beyond 2.1. Stay vigilant for further advisories and ensure your deployment pipelines include automated security testing for buffer overflows.

Watch the full video on YouTube: CVE-2024-25176

Remediation and exploitation details

This chain involves the following actors

  • Malicious Actor: Attempts to exploit the overflow to cause a crash or gain control
  • LuaJIT Integrator: Developer or user embedding LuaJIT up to version 2.1

This following systems are involved

  • LuaJIT (Just-in-time compiler for the Lua language): Contains the vulnerable formatting function

Attack entry point

  • lj_strfmt_wfnum in lj_strfmt_num.c: Formats numbers into a fixed-size stack buffer without proper size checks

Remediation actions

LuaJIT Integrator
Apply upstream patch or vendor security update
LuaJIT through version 2.1
LuaJIT Integrator
Upgrade to LuaJIT version containing the fix
LuaJIT 2.1.x or later with overflow guard in lj_strfmt_wfnum

Exploitation actions

Inject a format specifier that exceeds the buffer capacity

Malicious Actor
Craft a format string with an excessively large field width modifier
LuaJIT string formatter
Examples:
  • string.format("%100000f", 1.23)

Call LuaJIT’s formatter via Lua code or C API

Malicious Actor
Pass the malicious format string into the vulnerable function path
LuaJIT API for string formatting
Examples:
  • lua_pushstring(L, "%100000f"); lua_pushnumber(L, 1.23); lua_call(L, 2, 1)

Cause the function to write more characters than the fixed stack buffer can hold

Malicious Actor
Trigger stack‐buffer overflow inside lj_strfmt_wfnum
lj_strfmt_wfnum routine
Examples:
  • Overflow occurs when copying the formatted number into a local buffer

Use the overflow to corrupt control data on the stack

Malicious Actor
Overwrite adjacent stack data (frame pointer or return address)
Process stack frame for lj_strfmt_wfnum
Examples:
  • Return address overwritten to point at attacker‐controlled data

On function return, jump to corrupted address or invalid memory leading to code execution or denial of service

Malicious Actor
Hijack execution flow or provoke a crash
Affected application embedding LuaJIT
Examples:
  • Application segfaults or jumps to shellcode in overwritten stack

Related Content

NOTE: The following related content has not been vetted and may be unsafe.

CVE database technical details

CVE ID
CVE-2024-25176
Description
LuaJIT through 2.1 has a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c.
Provider
mitre
CWE / problem types
n/a
Affected Software Versions
n/a:n/a:[{'version': 'n/a', 'status': 'affected'}]
Date Published
2025-07-07T00:00:00.000Z
Last Updated
2025-07-08T17:36:53.675Z