13-Year-Old Redis RCE Flaw Lets Attackers Seize Complete Host Control
A critical vulnerability has been identified in Redis, an extensively utilized in-memory data structure store. This flaw, designated as CVE-2025-49844 , also known as "RediShell," has been assigned the maximum CVSS 3.1 severity score of 10.0, impacting…
A critical vulnerability has been identified in Redis, an extensively utilized in-memory data structure store. This flaw, designated as CVE-2025-49844 , also known as "RediShell," has been assigned the maximum CVSS 3.1 severity score of 10.0, impacting all Redis versions globally.
13-Year-Old Bug Creates Modern Security Crisis
Wiz Research has uncovered this significant vulnerability, which exploits a Use-After-Free memory corruption bug present in the Redis source code for approximately 13 years. This flaw allows authenticated attackers to execute specially crafted Lua scripts that escape the Lua sandbox environment, enabling arbitrary native code execution on the host system.
CVE ID Product Vulnerability Type Impact Attack Vector Authentication Required
CVE-2025-49844 Redis (all versions) Use-After-Free (UAF) Memory Corruption Remote Code Execution (RCE) Network Yes (Post-auth)
The impact of this vulnerability extends beyond data breaches. Successful exploitation allows attackers full control over the host system, enabling data exfiltration, deployment of ransomware or crypto miners, credential theft, and establishment of persistent backdoors for broader network infiltration.
A critical vulnerability has been identified in Redis, an extensively utilized in-memory data structure store.
Redis's widespread deployment in approximately 75% of cloud environments, as estimated by security researchers, underscores the critical nature of this vulnerability. Redis serves essential functions like caching, session management, and publish-subscribe messaging systems.
Analysis shows about 330,000 Redis instances are currently exposed to the internet, with approximately 60,000 lacking authentication configurations. The official Redis container image, used in 57% of cloud environments, does not require authentication by default, heightening risk.
Internal Redis deployments also present elevated risks. Many prioritize convenience over security, often lacking proper authentication, creating opportunities for attackers with network access to exploit the vulnerability for deeper penetration and privilege escalation.
The attack chain involves sending malicious Lua scripts that leverage the use-after-free vulnerability, escaping the Lua sandbox to achieve arbitrary code execution on the host system. This enables comprehensive system compromise, including credential theft and malware installation.
Redis published a security advisory on October 3, 2025, along with patched versions to address the vulnerability. Initially reported during Pwn2Own Berlin on May 16, 2025, this highlights the extended period organizations operated with this critical flaw.
This vulnerability, one of fewer than 300 to receive a maximum CVSS score in the past year, marks the first critical severity rating for a Redis-related vulnerability. Organizations are advised to prioritize remediation efforts urgently.
Based on reporting by GBHackers.