CVE-2026-24821

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-24821
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24821.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-24821
Published
2026-01-27T08:57:26.461Z
Modified
2026-07-15T15:30:19.274182Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:H/SI:N/SA:H/S:N/AU:Y/R:U/V:D/RE:M/U:Amber CVSS Calculator
Summary
A heap-based buffer over-read that might affect a system that compiles untrusted Lua code in turanszkij/WickedEngine.
Details

Out-of-bounds Read vulnerability in turanszkij WickedEngine (WickedEngine/LUA modules). This vulnerability is associated with program files lparser.C.

This issue affects WickedEngine: through 0.71.727.

Database specific 
{
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24821.json",
    "cna_assigner": "GovTech CSG"
}
References

Affected packages

Git / github.com/turanszkij/wickedengine

Affected ranges

Type
GIT
Repo
https://github.com/turanszkij/wickedengine
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bc128fe6eb9e898ac4478a4446af9519087905f2
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.71.727"
        },
        {
            "fixed": "0.71.727"
        }
    ]
}

Affected versions

0.*
0.12.2
0.56.34
v0.*
v0.42.2
v0.48.0
v0.49.1
v0.51.18
v0.59.3
v0.60.4
v0.60.61
v0.60.84
v0.70.0
v0.70.18
v0.71.100
v0.71.124
v0.71.137
v0.71.143
v0.71.176
v0.71.190
v0.71.195
v0.71.219
v0.71.239
v0.71.272
v0.71.285
v0.71.312
v0.71.338
v0.71.34
v0.71.354
v0.71.385
v0.71.392
v0.71.422
v0.71.446
v0.71.47
v0.71.473
v0.71.501
v0.71.531
v0.71.532
v0.71.563
v0.71.585
v0.71.613
v0.71.624
v0.71.645
v0.71.672
v0.71.705
v0.71.711

Database specific

vanir_signatures_modified 
"2026-07-15T15:30:19Z"
vanir_signatures 
[
    {
        "signature_type": "Function",
        "target": {
            "file": "WickedEngine/wiTerrain.cpp",
            "function": "Terrain::Generation_Update"
        },
        "deprecated": false,
        "source": "https://github.com/turanszkij/wickedengine/commit/bc128fe6eb9e898ac4478a4446af9519087905f2",
        "id": "CVE-2026-24821-1343fc65",
        "signature_version": "v1",
        "digest": {
            "function_hash": "309654032201599654221909799758471918271",
            "length": 19359.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "Editor/RigidBodyWindow.cpp",
            "function": "RigidBodyWindow::Create"
        },
        "deprecated": false,
        "source": "https://github.com/turanszkij/wickedengine/commit/bc128fe6eb9e898ac4478a4446af9519087905f2",
        "id": "CVE-2026-24821-166e2d2f",
        "signature_version": "v1",
        "digest": {
            "function_hash": "185636885287562368541487058784648836602",
            "length": 28232.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "WickedEngine/wiVersion.cpp"
        },
        "deprecated": false,
        "source": "https://github.com/turanszkij/wickedengine/commit/bc128fe6eb9e898ac4478a4446af9519087905f2",
        "id": "CVE-2026-24821-2a599204",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "284475753498198766531528939439642775107",
                "151128080216071124284569489605253292176",
                "263759432749961469684104960444505277643",
                "193487588931164758567423034670805892242"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "WickedEngine/wiPrimitive.cpp"
        },
        "deprecated": false,
        "source": "https://github.com/turanszkij/wickedengine/commit/bc128fe6eb9e898ac4478a4446af9519087905f2",
        "id": "CVE-2026-24821-5db27c08",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "168738247791917407984636686398907257242",
                "99043146508104877885953776373861554957",
                "97964416017026685380477702033105701267",
                "340075882229663180200370478043233198243"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "WickedEngine/wiPhysics_Jolt.cpp",
            "function": "CreateRigidBodyShape"
        },
        "deprecated": false,
        "source": "https://github.com/turanszkij/wickedengine/commit/bc128fe6eb9e898ac4478a4446af9519087905f2",
        "id": "CVE-2026-24821-6cef48ea",
        "signature_version": "v1",
        "digest": {
            "function_hash": "60022301980891556253018022811678250111",
            "length": 3451.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "WickedEngine/wiTerrain.cpp"
        },
        "deprecated": false,
        "source": "https://github.com/turanszkij/wickedengine/commit/bc128fe6eb9e898ac4478a4446af9519087905f2",
        "id": "CVE-2026-24821-9538acc1",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "107949174331447436392655174338702418286",
                "276235926162210852299151322571130658818",
                "73176718839933257858379644057998508492",
                "183362712903399360417531878308307530574",
                "240345436166431683561463365050262066491",
                "334423731309823460358954575679087844007",
                "82751030461921368571262318549859927900",
                "322079262206661187563319524660965836998",
                "17201218267680411213161509932753069631",
                "292960243344357131796199607604418341879",
                "183362712903399360417531878308307530574",
                "218490320451371928271320218664007762646",
                "257060408032053594075500131870747625019",
                "66069568161283765837881317047167541935"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "WickedEngine/wiPrimitive.h"
        },
        "deprecated": false,
        "source": "https://github.com/turanszkij/wickedengine/commit/bc128fe6eb9e898ac4478a4446af9519087905f2",
        "id": "CVE-2026-24821-97bc6fcb",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "159334054943096405490941272116971375429",
                "81067273971205647318096915636789002696",
                "295186802379606924905303114115962717067",
                "193712913995471966489264471206951099323"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "WickedEngine/wiScene_Components.h"
        },
        "deprecated": false,
        "source": "https://github.com/turanszkij/wickedengine/commit/bc128fe6eb9e898ac4478a4446af9519087905f2",
        "id": "CVE-2026-24821-be7887e3",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "215626623960252251465092344733555487865",
                "117404795895999593195822499389054997532",
                "279730291014801113773016030851354978520",
                "292272240562967920233828344266275302331"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "Editor/RigidBodyWindow.cpp"
        },
        "deprecated": false,
        "source": "https://github.com/turanszkij/wickedengine/commit/bc128fe6eb9e898ac4478a4446af9519087905f2",
        "id": "CVE-2026-24821-fd26a089",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "143885201864035743226960497096173475068",
                "148830761009646817732126925913916993311",
                "296115215098489481716937986393412362494",
                "30134639327223095708786098711357077752"
            ],
            "threshold": 0.9
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24821.json"