An authenticated use-after-free vulnerability in the Redis master-replica synchronization mechanism allows remote attackers to achieve remote code execution.

This flaw is classified as a Use After Free (CWE-416) within the Lua scripting and master-replica synchronization components, requiring low privileges (authenticated user access) to exploit.

A successful exploit of this vulnerability could allow an authenticated attacker to achieve remote code execution on affected database replicas, leading to a complete compromise of the underlying system. This level of impact poses severe risks to data confidentiality, integrity, and availability. The assigned CVSS score of 8.1 reflects a high severity rating due to the potential for total technical impact on affected nodes.

Immediate Action: Update the Redis server to version 8.6.3 or later where the vulnerability is patched.

Proactive Monitoring: Monitor database logs for unusual Lua script executions and abnormal master-replica synchronization behavior.

Compensating Controls: Restrict user permissions to prevent the execution of Lua scripts or enforce read-only configurations on replicas where feasible.

Public Exploit Available: Yes, public proof-of-concept repositories have been identified on GitHub.

Given the high CVSS score and the availability of public proof-of-concept code, administrators must treat this vulnerability with urgency. Apply the official vendor update to version 8.6.3 immediately to mitigate the risk of remote code execution.