The vulnerability is an out-of-bounds read in the Lua parser component of WickedEngine, which can expose internal memory contents when untrusted Lua scripts are compiled. This introduces a high risk of information disclosure. Identified by CWE-125, the flaw allows attackers to read beyond the bounds of a heap buffer, potentially revealing sensitive data.

The affected product is WickedEngine from turanszkij, in all releases through version 0.71.727. Lua modules that parse scripts using lparser.C are vulnerable.

The flaw carries a CVSS score of 9.3, indicating high severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation in the near term. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector requires the ability to submit malicious Lua code to the engine, either locally or over a network interface exposed by the application.