An out‑of‑bounds write occurs in the Lua modules ldebug.c and lvm.c of praydog UEVR, allowing an attacker to overwrite memory beyond the intended buffer. This flaw can potentially lead to arbitrary code execution or a denial of service.

The flaw exists in all releases of praydog UEVR before version 1.05; any installation of those releases is at risk.

Based on the description, it is inferred that an attacker would need the ability to supply malicious Lua input or execute a compromised script to trigger the vulnerable code. The CVSS score of 8.7 indicates high severity, while the EPSS score of less than 1% suggests a low probability of widespread active exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, implying it has not yet been observed in the wild.