CVE-2025-67482 PUBLISHED

Lua segfault in unpack()

Assigner: wikimedia-foundation
Reserved: 08.12.2025 Published: 03.02.2026 Updated: 03.02.2026

Vulnerability in Wikimedia Foundation Scribunto, Wikimedia Foundation luasandbox. This vulnerability is associated with program files includes/Engines/LuaCommon/lualib/mwInit.Lua, library.C.

This issue affects Scribunto: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1; luasandbox: from * before fea2304f8f6ab30314369a612f4f5b165e68e95a.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
CVSS Score: 1.7

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	None	Confidentiality	None
Attack Complexity	High	Integrity	None	Integrity	None
Attack Requirements	Present	Availability	Low	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	Wikimedia Foundation
Product	Scribunto
Versions	Default: unaffected affected from * to 1.39.16, 1.43.6, 1.44.3, 1.45.1 (excl.)

Vendor	Wikimedia Foundation
Product	luasandbox
Versions	Default: unaffected affected from * to fea2304f8f6ab30314369a612f4f5b165e68e95a (excl.)

References

https://phabricator.wikimedia.org/T408135