“As the vulnerability has been patched for months already (Factorio versions below 1.1.101 are affected), is time to share the details with the community.”
Factorio’s multiplayer runs in deterministic lockstep, so every client has to execute the Lua code inside the server’s map. That turned an off-by-one in a custom bytecode verifier into code execution on any player who joined a malicious server. The game has sold 3,500,000 copies. A memory-safe scripting language is only as safe as the C underneath it.