PoC Exploit Released for Critical Vulnerabilities in Lua Engine
Recent security research has revealed a proof-of-concept exploit for critical vulnerabilities in the Lua scripting engine used by Redis 7.4.5. These vulnerabilities, identified as CVE-2025-49844, CVE-2025-46817, and CVE-2025-46818, allow attackers to…
Recent security research has revealed a proof-of-concept exploit for critical vulnerabilities in the Lua scripting engine used by Redis 7.4.5. These vulnerabilities, identified as CVE-2025-49844, CVE-2025-46817, and CVE-2025-46818, allow attackers to execute remote code and escalate privileges by exploiting the Lua parser, the unpack() function, and basic type metatable protections.
The vulnerabilities were discovered during an audit of Redis 7.4.5. The first vulnerability, CVE-2025-49844, is a use-after-free flaw in the Lua parser, which fails to secure a TString object on the stack during script parsing. A garbage collection cycle could prematurely free this object, leading to memory overwrite and arbitrary code execution.
The second issue, CVE-2025-46817, involves an integer overflow in the unpack() function. By using extreme index values, an attacker can cause a stack overflow and gain control over the execution flow.
The third vulnerability, CVE-2025-46818, pertains to privilege escalation through modifiable core type metatables. These metatables, which govern strings, numbers, and other primitives, can be altered to execute malicious code within different user contexts.
CVE Vulnerability Impact Exploit Prerequisites CVSS 3.1 Score
Recent security research has revealed a proof-of-concept exploit for critical vulnerabilities in the Lua scripting engine used by Redis 7.4.5.
CVE-2025-49844 Use-After-Free in Lua Parser Remote Code Execution EVAL access 9.8
CVE-2025-46817 Integer Overflow in unpack() Remote Code Execution EVAL access 9.8
CVE-2025-46818 Metatable Privilege Escalation Privilege Escalation EVAL access 9.8
A Python proof-of-concept (PoC) has been developed to test these vulnerabilities against a live Redis server. The PoC demonstrates how to induce a memory pressure to force garbage collection, trigger integer overflow, and modify metatables.
Organizations are advised to upgrade to Redis version 7.4.6 or later, where patches have been implemented. These include stack protection in the parser, bounds checks in unpack() , and read-only enforcement on basic metatables. Applying these updates is essential to close potential attack vectors and ensure script isolation. Additionally, continuous monitoring of EVAL command activity and enforcing strict access controls are recommended to further mitigate risks.
Based on reporting by GBHackers.