{"id":"CVE-2026-25243","published":"2026-05-05T16:44:57Z","modified":"2026-07-16T12:04:33Z","title":"redis-server RESTORE invalid memory access may allow remote code execution","vendor":"redis","product":"redis","tier":"core","eol":null,"affectedVersions":[{"vendor":"redis","product":"redis","versions":["< 8.6.3"]}],"description":{"text":"Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":7.7,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.04033,"percentile":0.90588,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-10-17","exploitedFirstSeen":"2026-10-17","ransomware":false,"evidence":[{"url":"https://x.com/DefusedCyber/status/2111394668713857446","date":"2026-10-17"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":10,"pulses":[{"name":"Debian Patches Multiple Redis Flaws Allowing Denial of Service and Arbitrary Code Execution","url":"https://otx.alienvault.com/pulse/6abfdcac7ffd8e41b39b3678","created":"2026-10-02"},{"name":"Redis Authenticated RCE via RESTORE (Streams UAF / RedisBloom TDigest) — July 2026","url":"https://otx.alienvault.com/pulse/6a66f4a43fdeb1c044511c37","created":"2026-07-27"},{"name":"Known_Cve | May 14, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a0487a01a4a82d9d068e332","created":"2026-05-13"},{"name":"Known_Cve | May 13, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a033614c2ffc68639c724b6","created":"2026-05-12"},{"name":"Known_Cve | May 12, 2026","url":"https://otx.alienvault.com/pulse/6a01e46d5f244e70404ff2c4","created":"2026-05-11"},{"name":"Known_Cve | May 11, 2026","url":"https://otx.alienvault.com/pulse/6a0092f454354dab01de3bef","created":"2026-05-10"},{"name":"Known_Cve | May 10, 2026","url":"https://otx.alienvault.com/pulse/69ff4160e930613f7b38fcf5","created":"2026-05-09"},{"name":"Known_Cve | May 9, 2026","url":"https://otx.alienvault.com/pulse/69fdf011c783e0baada3fcd1","created":"2026-05-08"},{"name":"Known_Cve | May 8, 2026","url":"https://otx.alienvault.com/pulse/69fc9ec9766595ae8bb6d07c","created":"2026-05-07"},{"name":"Known_Cve | May 7, 2026","url":"https://otx.alienvault.com/pulse/69fb4ce6957faa5ed109be64","created":"2026-05-06"}],"provenance":"machine"},"cwes":[{"id":"CWE-122","name":"Heap-based Buffer Overflow"}],"references":[{"url":"https://github.com/redis/redis/security/advisories/GHSA-c8h9-259x-jff4","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/redis/redis/releases/tag/8.6.3","tags":["x_refsource_MISC"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25243","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466828","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25243.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26540","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25216","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26008","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27787","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:29817","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33427","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27716","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28139","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28142","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26233","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26306","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23229","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25219","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25925","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14316","tags":["vendor-advisory","x_refsource_REDHAT"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-27410","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-27410","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":0,"earliest":"2026-06-13","earliestUrl":"https://github.com/dinosn/CVE-2026-25243","repos":[{"name":"dinosn/CVE-2026-25243","url":"https://github.com/dinosn/CVE-2026-25243","stars":14,"created":"2026-06-13"},{"name":"dinosn/CVE-2026-25243-debugfree","url":"https://github.com/dinosn/CVE-2026-25243-debugfree","stars":2,"created":"2026-07-02"},{"name":"captain-woof/CVE-2026-25243","url":"https://github.com/captain-woof/CVE-2026-25243","stars":1,"created":"2026-08-06"}]},"first":{"date":"2026-06-13","source":"PoC-in-GitHub","url":"https://github.com/dinosn/CVE-2026-25243"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-05-05","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-25243","provenance":"source"},{"date":"2026-06-13","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/dinosn/CVE-2026-25243","provenance":"source"},{"date":"2026-10-17","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://x.com/DefusedCyber/status/2111394668713857446","provenance":"source"}],"speed":{"daysToPublicExploit":39,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":75.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 14 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.12,"detail":"percentile 0.9059"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":2.36,"detail":"10 pulses"},{"name":"CVSS severity","points":5.39,"detail":"base score 7.7"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-redis-cve-2026-25243","children":[{"from":"CVE-2026-25243","to":"CVE-2026-66373","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.","from":"CVE.org","in":"CVE-2026-66373"}]}]}}