CVE-2026-25243: redis Heap-based Buffer Overflow
CVSS: 8.8v3.1HighModified
AliasesALPINE-CVE-2026-25243RHSA-2026:23229RHSA-2026:26008RHSA-2026:26233RHSA-2026:27716RHSA-2026:27787RHSA-2026:28139RHSA-2026:28142RHSA-2026:29817RHSA-2026:33427UBUNTU-CVE-2026-25243DEBIAN-CVE-2026-25243CGA-3c3g-p5m4-r8xhCGA-67rr-hw45-hv48CGA-67v4-4pj8-8f9gCGA-75w4-2hcc-wqfgCGA-8g8r-g95p-2rr8CGA-8v27-m8ff-8vvxCGA-cvx7-h7xq-595hCGA-h2fj-jfq9-jvhfCGA-h9m9-ph9h-6c2wCGA-jfmg-6783-q5vvCGA-jhvw-m53v-7qcjCGA-vp8q-rvmf-mvxmCGA-x2g3-g74j-8h57
Published 05-05-2026Last modified 16-07-2026
Vulnerability summary
CVE-2026-25243 is a high (CVSS 8.8) Heap-based Buffer Overflow vulnerability in redis. EPSS estimates a 3.66% chance of exploitation in the next 30 days, higher than 89.5% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.1 (CVE.org)EPSS score
3.66%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 10 · Related 4Timeline
- 05-05-2026PublishedVulnerability first disclosed.
- 16-07-2026Last modifiedVulnerability information updated.
Description
Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.
CVSS metrics
10 scores · 7 sources · 2 versionsHigh 7.7Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated7.7HighCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated7.7HighCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- NVDNIST7.7HighCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 8.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesAll 6 agree
- OSV · AlpineEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
3.66%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
0.00 pp
From 3.66% on 19-09-2026
19-09-202619-10-2026
EPSS score3.66%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard7 products
- py3-redisAll versions (No fix recorded)
- py3.10-redisAll versions (No fix recorded)
- py3.11-redisAll versions (No fix recorded)
- py3.12-redisAll versions (No fix recorded)
- py3.13-redisAll versions (No fix recorded)
Redhat5 products
- redis< 0:6.2.7-1.module+el8.8.0+24465+9d14ca70.7 | < 0:6.2.22-1.el9_8 | < 0:6.2.22-1.module+el8.10.0+24332+dbd3b426 | < 0:6.2.22-1.el9_6 | < 0:6.2.7-1.el9_2.6 | < 0:6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6 | < 0:6.2.7-1.el9_4.6 | < 0:7.0.12-2.module+el9.4.0+24422+b373a9c6.7 | < 0:6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7
- redis-debuginfo< 0:6.2.7-1.module+el8.8.0+24465+9d14ca70.7 | < 0:6.2.22-1.el9_8 | < 0:6.2.22-1.module+el8.10.0+24332+dbd3b426 | < 0:6.2.22-1.el9_6 | < 0:6.2.7-1.el9_2.6 | < 0:6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6 | < 0:6.2.7-1.el9_4.6 | < 0:7.0.12-2.module+el9.4.0+24422+b373a9c6.7 | < 0:6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7
- redis-debugsource< 0:6.2.7-1.module+el8.8.0+24465+9d14ca70.7 | < 0:6.2.22-1.el9_8 | < 0:6.2.22-1.module+el8.10.0+24332+dbd3b426 | < 0:6.2.22-1.el9_6 | < 0:6.2.7-1.el9_2.6 | < 0:6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6 | < 0:6.2.7-1.el9_4.6 | < 0:7.0.12-2.module+el9.4.0+24422+b373a9c6.7 | < 0:6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7
- redis-devel< 0:6.2.7-1.module+el8.8.0+24465+9d14ca70.7 | < 0:6.2.22-1.el9_8 | < 0:6.2.22-1.module+el8.10.0+24332+dbd3b426 | < 0:6.2.22-1.el9_6 | < 0:6.2.7-1.el9_2.6 | < 0:6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6 | < 0:6.2.7-1.el9_4.6 | < 0:7.0.12-2.module+el9.4.0+24422+b373a9c6.7 | < 0:6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7
- redis-doc< 0:6.2.7-1.module+el8.8.0+24465+9d14ca70.7 | < 0:6.2.22-1.el9_8 | < 0:6.2.22-1.module+el8.10.0+24332+dbd3b426 | < 0:6.2.22-1.el9_6 | < 0:6.2.7-1.el9_2.6 | < 0:6.0.9-5.module+el8.4.0+24416+a7ffbc5f.6 | < 0:6.2.7-1.el9_4.6 | < 0:7.0.12-2.module+el9.4.0+24422+b373a9c6.7 | < 0:6.0.9-5.module+el8.6.0+24434+c7b1e4bc.7
Debian3 products
- redictAll versions (No fix recorded)
- redis< 5:7.0.15-1~deb12u8 | < 5:8.0.2-3+deb13u3 | < 5:8.0.6-3
- valkeyAll versions (No fix recorded) | < 9.1.1-1
Alpine1 product
- valkey< 7.2.13-r0 | < 8.1.7-r0 | < 9.0.4-r0
Redis1 product
- redis< 8.6.3
Ubuntu1 product
- redisAll versions (No fix recorded)
6 vendors · 18 products
References
36 links- github.com/redis/redis/security/advisories/GHSA-c8h9-259x-jff4X Refsource CONFIRMARTICLEAdvisoryMitigationVendor Advisory
