# CVE-2026-25243: Redis RESTORE command invalid memory access leading to RCE

Source: https://junglewise.ai/threats/cve-2026-25243-redis-restore-command-invalid-memory-access-leading-to-rce  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-05. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-25243 · Severity: high · CVSS 8.8 · Published 2026-05-05

Redis is a popular in-memory database used for caching and high-speed data storage. A vulnerability in its data restoration feature allows an authorized user to send a specially crafted data package that can crash the server or allow the attacker to run unauthorized commands. This could lead to a total system takeover, data theft, or a complete shutdown of services relying on the database.

Technologies: [Red Hat Enterprise Linux AppStream](https://junglewise.ai/threats/technologies/enterprise-linux-appstream). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-25243 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25243 being exploited in the wild.

**How severe is CVE-2026-25243?** High severity, with a CVSS score of 8.8, published 5 May 2026.

**Which products and versions are affected?** Red Hat Enterprise Linux AppStream All versions.

**Is there a fix for CVE-2026-25243?** A patch was published on 2026-05-05: Redis version 8.6.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25243 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-25243?** Check whether you run Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow (CWE-122) exists in the Redis RESTORE command due to insufficient validation of serialized values. An authenticated attacker with permission to execute the RESTORE command can provide a crafted serialized payload that triggers invalid memory access. This can result in a crash (denial of service) or arbitrary code execution in the context of the Redis server process. The vulnerability is reachable over the network if the Redis instance is exposed and the attacker has valid credentials. A fix is available in version 8.6.3, and a workaround involves using Access Control Lists (ACLs) to restrict access to the RESTORE command.

## Affected products

- Redis Redis Server up to 8.6.3
- Red Hat Red Hat Enterprise Linux AppStream (v. 8, 9, 10) All versions

## Timeline

- 2026-05-05: disclosed: Advisory published by Redis and GitHub
- 2026-05-05: patched: Redis version 8.6.3 released
- 2026-06-04: advisory: Red Hat security advisory RHSA-2026:23229 issued

## References

- [https://github.com/redis/redis/releases/tag/8.6.3](https://github.com/redis/redis/releases/tag/8.6.3)
- [https://github.com/redis/redis/security/advisories/GHSA-c8h9-259x-jff4](https://github.com/redis/redis/security/advisories/GHSA-c8h9-259x-jff4)
- [https://access.redhat.com/errata/RHSA-2026:23229](https://access.redhat.com/errata/RHSA-2026:23229)
- [https://access.redhat.com/errata/RHSA-2026:25216](https://access.redhat.com/errata/RHSA-2026:25216)
- [https://access.redhat.com/errata/RHSA-2026:25219](https://access.redhat.com/errata/RHSA-2026:25219)
- [https://access.redhat.com/errata/RHSA-2026:25925](https://access.redhat.com/errata/RHSA-2026:25925)
- [https://access.redhat.com/errata/RHSA-2026:26008](https://access.redhat.com/errata/RHSA-2026:26008)

## Related threats

- [CESNET libyang heap buffer overflow in lyb_read_string](https://junglewise.ai/threats/cve-2026-44673-cesnet-libyang-heap-buffer-overflow-in-lyb-read-string)
- [dnsmasq heap out-of-bounds read in extract_addresses](https://junglewise.ai/threats/cve-2026-5172-dnsmasq-heap-out-of-bounds-read-in-extract-addresses)
- [dnsmasq heap out-of-bounds read in DNSSEC validation](https://junglewise.ai/threats/cve-2026-4891-dnsmasq-heap-out-of-bounds-read-in-dnssec-validation)
- [dnsmasq infinite loop in DNSSEC NSEC parsing](https://junglewise.ai/threats/cve-2026-4890-dnsmasq-infinite-loop-in-dnssec-nsec-parsing)
- [PHP DOMNode::C14N() denial of service via circular linked list](https://junglewise.ai/threats/cve-2026-7263-php-domnode-c14n-denial-of-service-via-circular-linked-list)