Is CVE-2026-25243 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25243 being exploited in the wild.

How severe is CVE-2026-25243?

High severity, with a CVSS score of 8.8, published 5 May 2026.

Which products and versions are affected?

Red Hat Enterprise Linux AppStream All versions.

Is there a fix for CVE-2026-25243?

A patch was published on 2026-05-05: Redis version 8.6.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25243 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-25243?

Check whether you run Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25243: Redis RESTORE command invalid memory access leading to RCE

CVE-2026-25243 · Severity: high · CVSS 8.8 · Published 2026-05-05

Redis is a popular in-memory database used for caching and high-speed data storage. A vulnerability in its data restoration feature allows an authorized user to send a specially crafted data package that can crash the server or allow the attacker to run unauthorized commands. This could lead to a total system takeover, data theft, or a complete shutdown of services relying on the database.

Technologies: Red Hat Enterprise Linux AppStream. Vendors: Red Hat.

Quick answers

Is CVE-2026-25243 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25243 being exploited in the wild.
How severe is CVE-2026-25243?: High severity, with a CVSS score of 8.8, published 5 May 2026.
Which products and versions are affected?: Red Hat Enterprise Linux AppStream All versions.
Is there a fix for CVE-2026-25243?: A patch was published on 2026-05-05: Redis version 8.6.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25243 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-25243?: Check whether you run Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow (CWE-122) exists in the Redis RESTORE command due to insufficient validation of serialized values. An authenticated attacker with permission to execute the RESTORE command can provide a crafted serialized payload that triggers invalid memory access. This can result in a crash (denial of service) or arbitrary code execution in the context of the Redis server process. The vulnerability is reachable over the network if the Redis instance is exposed and the attacker has valid credentials. A fix is available in version 8.6.3, and a workaround involves using Access Control Lists (ACLs) to restrict access to the RESTORE command.

Affected products

Redis Redis Server up to 8.6.3
Red Hat Red Hat Enterprise Linux AppStream (v. 8, 9, 10) All versions

Timeline

2026-05-05: disclosed: Advisory published by Redis and GitHub
2026-05-05: patched: Redis version 8.6.3 released
2026-06-04: advisory: Red Hat security advisory RHSA-2026:23229 issued

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.