🟠 High | Source: Microsoft Security Response Center
CVE-2019-6706 is a use-after-free vulnerability in Lua 5.3.5, specifically within the lua_upvaluejoin function in lapi.c. An attacker who can trigger a debug.upvaluejoin call with specially crafted arguments may cause a crash or potentially achieve code execution. Microsoft has published this advisory in relation to Azure, indicating Lua is a dependency within an affected Azure component.
Security Architect’s Take: Identify any Azure services or workloads in your environment that embed Lua 5.3.5 and ensure they are patched to a remediated version. Pay particular attention to services that expose Lua scripting interfaces to untrusted users, such as Redis instances or custom runtimes, as these present the highest exploitation risk.