# CVE-2026-7827: FalkorDB stack-based buffer overflow in RDB graph entity decoder

Source: https://junglewise.ai/threats/cve-2026-7827-a-stack-based-buffer-overflow-in-the-rdbloadentity-function-of-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-7827 · Severity: high · CVSS 8.1 · Published 2026-10-09

FalkorDB is a graph database that processes data through Redis replication commands. An attacker who can send replication commands to an unauthenticated or weakly-secured instance can trigger a stack buffer overflow by sending a crafted RDB file with an extremely high entity property count, causing the database to crash or potentially execute arbitrary code.

Technologies: [FalkorDB](https://junglewise.ai/threats/technologies/falkordb). Vendors: [FalkorDB](https://junglewise.ai/threats/vendors/falkordb).

## Quick answers

**Is CVE-2026-7827 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7827 being exploited in the wild.

**How severe is CVE-2026-7827?** High severity, with a CVSS score of 8.1, published 9 October 2026.

**Which products and versions are affected?** FalkorDB before 4.18.4.

**Is there a fix for CVE-2026-7827?** Yes: fixed in FalkorDB 4.18.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-7827 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-7827?** Check whether you run FalkorDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in FalkorDB 4.18.4

## Technical details

A stack-based buffer overflow exists in the _RdbLoadEntity function within RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c), where variable-length arrays are sized on the thread stack using an attacker-controlled property count from the RDB stream with no upper bounds. An attacker with access to Redis replication commands can supply a crafted RDB stream to exhaust stack memory and trigger code execution or denial of service. The fix replaces VLA allocations with bounded heap allocations and adds UINT16_MAX checks.

## Affected products

- FalkorDB FalkorDB before 4.18.4

## Timeline

- 2026-10-09: disclosed
- 2026-05-07: patched

## References

- [https://github.com/FalkorDB/FalkorDB](https://github.com/FalkorDB/FalkorDB)
- [https://github.com/FalkorDB/FalkorDB/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94](https://github.com/FalkorDB/FalkorDB/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94)

## Related threats

- [FalkorDB type confusion in _read_flags function](https://junglewise.ai/threats/cve-2026-107911-a-type-confusion-vulnerability-in-the-read-flags-function-src)
- [FalkorDB improper authentication in Bolt endpoint](https://junglewise.ai/threats/cve-2026-107910-an-improper-authentication-vulnerability-in-the-is-authenticated)
- [FalkorDB heap-based buffer overflow in WebSocket frame handling](https://junglewise.ai/threats/cve-2026-107909-a-heap-based-out-of-bounds-write-in-the-ws-read-frame-function)
- [FalkorDB heap-based buffer overflow in Bolt handler](https://junglewise.ai/threats/cve-2026-107908-a-heap-based-out-of-bounds-write-in-the-boltreadhandler-function)
- [FalkorDB heap-based out-of-bounds read in buffer serializer](https://junglewise.ai/threats/cve-2026-7826-a-heap-based-out-of-bounds-read-in-the-bufferserializeriov2)