A stack buffer overflow exists in the Lua bit.tohex() function used by Apache Kvrocks. The flaw allows a malformed input to overflow a stack buffer, potentially enabling an attacker to supply arbitrary code. This weakness is classified as CWE‑122 and can lead to compromise of the system running Kvrocks.

Apache Kvrocks versions 2.0.4 through 2.15.0 are affected. Users should upgrade to version 2.16.0 to resolve the issue.

The CVSS score is 10, indicating critical severity. No EPSS score is currently available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely remote, as the flaw can be triggered by any entity that can execute Lua scripts within Kvrocks, such as network-connected clients. Given the high CVSS score and the ability to eschew existing security controls in environments where Lua scripts are enabled, the risk of exploitation remains significant.