This vulnerability involves a heap‑buffer overflow in the luaG_runerror function of the Lua debugging component (ldebug.c) used by praydog/REFramework before version 1.5.5. The overflow arises when a recursive error condition triggers, allowing an attacker to overwrite adjacent heap memory. This constitutes a memory‑corruption flaw (CWE‑787) that can lead to a crash, denial of service, or potentially arbitrary code execution if the attacker can influence the data written.

The vulnerable component is part of praydog's REFramework. Any deployment of REFramework with a version earlier than 1.5.5 is affected. Versions 1.5.5 and later incorporate a fix that prevents the overflow.

The CVSS score of 6.9 signals a medium‑to‑high impact, while an EPSS score of less than 1% indicates a very low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Because the overflow is triggered by a recursive error, the likely attack vector is within contexts where REFramework processes scripts or input that can provoke such an error. This inference is based on the description; no explicit attack scenario is provided in the data.