Junglewise Threat Intelligence

CVE-2026-25243: Redis RESTORE command invalid memory access leading to RCE

CVE-2026-25243 · Severity: high · CVSS 8.8 · Published 2026-05-05

Technologies: Red Hat Enterprise Linux AppStream. Vendors: Red Hat.

Executive brief

Redis is a popular in-memory database used for caching and high-speed data storage. A vulnerability in its data restoration feature allows an authorized user to send a specially crafted data package that can crash the server or allow the attacker to run unauthorized commands. This could lead to a total system takeover, data theft, or a complete shutdown of services relying on the database.

Technical details

A heap-based buffer overflow (CWE-122) exists in the Redis RESTORE command due to insufficient validation of serialized values. An authenticated attacker with permission to execute the RESTORE command can provide a crafted serialized payload that triggers invalid memory access. This can result in a crash (denial of service) or arbitrary code execution in the context of the Redis server process. The vulnerability is reachable over the network if the Redis instance is exposed and the attacker has valid credentials. A fix is available in version 8.6.3, and a workaround involves using Access Control Lists (ACLs) to restrict access to the RESTORE command.

Affected products

  • Redis Redis Server up to 8.6.3
  • Red Hat Red Hat Enterprise Linux AppStream (v. 8, 9, 10) All versions

Timeline

  • 2026-05-05: disclosed: Advisory published by Redis and GitHub
  • 2026-05-05: patched: Redis version 8.6.3 released
  • 2026-06-04: advisory: Red Hat security advisory RHSA-2026:23229 issued

References

Related threats