Executive brief
FalkorDB is a graph database module for Redis that stores and processes network data. Versions 4.20.1 to 4.20.4 contain a buffer overflow in the code that deserializes saved graphs, allowing an authenticated attacker or a corrupted database file to cause the database process to crash or potentially corrupt memory. The vulnerability affects both direct restore commands and automatic database loading.
Technical details
A buffer overflow exists in _Decode_GrB_Matrix (decode_matrix.c v19) where an attacker-controlled buffer length is not validated before casting a stream buffer to a GxB_Container struct. An ineffective ASSERT check is the only validation, and it becomes a no-op in release builds. The short buffer is then passed to _decode_and_load_vector which writes live heap pointers out-of-bounds, and uninitialized struct fields are consumed by GraphBLAS library functions as trusted metadata, enabling type confusion and memory corruption.
Affected products
- FalkorDB FalkorDB 4.20.1 to 4.20.4
Timeline
- 2026-08-08: disclosed: Issue reported to security@falkordb.com and filed publicly on GitHub
- 2026-09-21: advisory: NVD advisory published with CVE-2026-88409