# CVE-2026-5759: FalkorDB double free and use-after-free in RDB graph decoder

Source: https://junglewise.ai/threats/cve-2026-5759-a-double-free-and-use-after-free-vulnerability-in-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-5759 · Severity: critical · CVSS 9.8 · Published 2026-10-09

FalkorDB is a graph database built on top of Redis. A vulnerability in the RDB (Redis Database) decoder allows an attacker with replication command access to send a malformed graph database file that causes the Redis server process to crash or execute arbitrary code, disrupting service and potentially compromising the underlying system.

Technologies: [FalkorDB](https://junglewise.ai/threats/technologies/falkordb). Vendors: [FalkorDB](https://junglewise.ai/threats/vendors/falkordb).

## Quick answers

**Is CVE-2026-5759 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5759 being exploited in the wild.

**How severe is CVE-2026-5759?** Critical severity, with a CVSS score of 9.8, published 9 October 2026.

**Which products and versions are affected?** FalkorDB before 4.18.1.

**Is there a fix for CVE-2026-5759?** Yes: fixed in FalkorDB 4.18.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5759 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-5759?** Check whether you run FalkorDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in FalkorDB 4.18.1

## Technical details

The RdbLoadDeletedNodes function in the RDB graph decoders lacks proper validation of the deleted-nodes buffer length in release builds, relying only on ASSERT() which is compiled out. When a crafted RDB stream has a buffer length not aligned to sizeof(NodeID), the function frees the buffer but then reads and frees it again, causing use-after-free and double-free conditions. An attacker with Redis replication command access can exploit this with a specially crafted RDB stream.

## Affected products

- FalkorDB FalkorDB before 4.18.1

## Timeline

- 2026-10-09: disclosed

## References

- [https://github.com/FalkorDB/FalkorDB](https://github.com/FalkorDB/FalkorDB)
- [https://github.com/FalkorDB/FalkorDB/commit/523d98ac7ffe99f11a9c95c258025c235f0dff4c](https://github.com/FalkorDB/FalkorDB/commit/523d98ac7ffe99f11a9c95c258025c235f0dff4c)

## Related threats

- [FalkorDB type confusion in _read_flags function](https://junglewise.ai/threats/cve-2026-107911-a-type-confusion-vulnerability-in-the-read-flags-function-src)
- [FalkorDB improper authentication in Bolt endpoint](https://junglewise.ai/threats/cve-2026-107910-an-improper-authentication-vulnerability-in-the-is-authenticated)
- [FalkorDB heap-based buffer overflow in WebSocket frame handling](https://junglewise.ai/threats/cve-2026-107909-a-heap-based-out-of-bounds-write-in-the-ws-read-frame-function)
- [FalkorDB heap-based buffer overflow in Bolt handler](https://junglewise.ai/threats/cve-2026-107908-a-heap-based-out-of-bounds-write-in-the-boltreadhandler-function)
- [FalkorDB stack-based buffer overflow in RDB graph entity decoder](https://junglewise.ai/threats/cve-2026-7827-a-stack-based-buffer-overflow-in-the-rdbloadentity-function-of-the)