Redis Server Vulnerability use-after-free Vulnerability Enables Remote Code Execution

A critical use-after-free vulnerability, designated as CVE-2025-49844, has been identified in Redis servers. This vulnerability enables authenticated attackers to execute remote code.

This high-severity vulnerability affects all Redis versions that incorporate the Lua scripting engine, posing a significant threat to numerous deployments utilizing this in-memory data store. The issue arises from Redis’s memory management within its Lua scripting component. An authenticated user with permissions to execute Lua scripts can craft a malicious script to manipulate the server’s garbage collector, leading to a use-after-free condition. This condition is a type of memory corruption flaw where the application attempts to access memory that has already been freed.

An attacker exploiting this condition can alter the application’s execution flow, resulting in the execution of arbitrary code on the server. This could allow the attacker to gain control over the Redis instance and the underlying system. The potential for remote code execution classifies this as a critical vulnerability, risking the confidentiality, integrity, and availability of data stored within the Redis database.

Attackers could potentially steal sensitive information, modify or delete records, or cause a denial-of-service condition. Additionally, a compromised Redis server could facilitate lateral movement within a network, allowing attackers to escalate privileges and target other internal systems.

CVE ID Affected Product(s) Impact Exploit Prerequisites CVSS 3.1 Score

CVE-2025-49844 All Redis versions with Lua scripting Remote Code Execution Authenticated access with permissions to execute Lua scripts To be determined

While awaiting a formal security patch, a workaround is available to mitigate the risk. Administrators are advised to prevent users from executing Lua scripts, the primary attack vector. This can be achieved by modifying Redis Access Control Lists (ACLs) to restrict the EVAL and EVALSHA commands. Blocking these commands will prevent the execution of malicious scripts, effectively neutralizing the threat.

This workaround provides immediate defense without requiring updates to the redis-server executable and should be prioritized in all production environments. The issue was responsibly disclosed by researchers Benny Isaacs, Nir Brakha, and Sagi Tzadik of Wiz, in collaboration with Trend Micro’s Zero Day Initiative.

Based on reporting by Cyber Security News.