A heap-based buffer overflow vulnerability in Redis versions prior to 8.6.3 allows authenticated attackers to achieve remote code execution through crafted serialized payloads.

This flaw is a heap-based buffer overflow (CWE-122) triggered by the RESTORE command failing to properly validate serialized values, requiring low privileges for an authenticated attacker over the network.

A successful exploit of this vulnerability could lead to total system compromise, resulting in unauthorized data access, data modification, or complete service disruption. Given the high CVSS score of 8.8, the potential business impact includes severe reputational damage, operational downtime, and potential regulatory penalties resulting from a compromised database infrastructure.

Immediate Action: Update Redis to version 8.6.3 or later where the memory validation issue is patched.

Proactive Monitoring: Monitor database access logs for suspicious execution patterns of the RESTORE command and review account permissions.

Compensating Controls: Restrict access to the RESTORE command using Redis Access Control List rules as an interim mitigation if immediate patching is not possible.

Public Exploit Available: Yes, public proof-of-concept repositories exist on GitHub.

Administrators should treat this vulnerability with high urgency due to the potential for remote code execution and the availability of public proof-of-concept exploits. Apply the vendor security update to version 8.6.3 immediately, and audit current ACL rules to limit command execution privileges across all database instances.