PoC Exploit Released for Critical Lua Engine Vulnerabilities
Three newly disclosed vulnerabilities have been identified in the Lua scripting engine of Redis 7.4.5. These vulnerabilities present significant risks of remote code execution and privilege escalation.
Three newly disclosed vulnerabilities have been identified in the Lua scripting engine of Redis 7.4.5. These vulnerabilities present significant risks of remote code execution and privilege escalation.
This vulnerability occurs due to inadequate protection of TString objects during script parsing. In the luaY_parser function, the Lua parser fails to secure a newly created TString, making it vulnerable to premature garbage collection and use-after-free conditions. The patched code ensures protection by preserving the object on the stack before parsing. Attackers can exploit this vulnerability by triggering garbage collection during the parsing process, potentially leading to remote code execution.
Integer Overflow Vulnerability (CVE-2025-46817)
The unpack() function incorrectly calculates element counts, which can lead to stack corruption when called with extreme range parameters. By using arguments such as unpack({1,2,3}, -2, 2147483647), attackers can bypass array bounds and may execute arbitrary code.
Metatable Privilege Escalation Flaw (CVE-2025-46818)
This flaw allows modification of critical metatables, such as those for strings and numbers, due to inadequate read-only protection. By altering metatables, attackers may inject logic that results in privilege escalation or code execution within the context of other users.
RedRays has released a Python-based proof-of-concept (PoC) that verifies the critical nature of all three vulnerabilities. The PoC includes:
Three newly disclosed vulnerabilities have been identified in the Lua scripting engine of Redis 7.4.5.
Stress tests for use-after-free exploitation (CVE-2025-49844). Fuzzing of the unpack() call to trigger integer overflow and stack corruption (CVE-2025-46817). Manipulation of basic type metatables to demonstrate privilege escalation via crafted Lua scripts (CVE-2025-46818).
The PoC connects to a target Redis instance and performs up to ten full-stack tests, confirming the presence or absence of proper patching. These tests utilize custom Lua scripts sent via Redis EVAL commands, exposing vulnerable server states and providing crash/output evidence.
CVE Title Severity
CVE-2025-49844 Use-After-Free in Lua Parser (deps/lua/src/lparser.c:387) Critical
CVE-2025-46817 Integer Overflow in unpack() (deps/lua/src/lbaselib.c) Critical
CVE-2025-46818 Metatable Privilege Escalation (script_lua.c, eval.c) Critical
Redis administrators should update to patched versions immediately. These vulnerabilities, confirmed through source review and practical exploitation, expand the Redis attack surface, especially where EVAL access is available. Organizations using Redis 7.4.5 should deploy fixes without delay to prevent potential remote code execution and unauthorized privilege escalation. Immediate patching is essential for all internet-facing or untrusted Redis deployments.
Based on reporting by Cyber Security News.