Buffer Overflow in Redis 8.2.0 and Above
CVE-2025-62507
Key Information:
Badges
What is CVE-2025-62507?
Redis, the open source in-memory database, is prone to a stack buffer overflow vulnerability in versions 8.2.0 and later. When a user executes the XACKDEL command with multiple IDs, it can trigger this overflow, potentially leading to remote code execution. Version 8.2.3 addresses this issue. To protect against this vulnerability without immediate patching, administrators can limit user access to the XACKDEL command by setting up Access Control Lists (ACL). This measure can effectively mitigate risks until the software can be updated.
Affected Version(s)
redis >= 8.2.0, < 8.2.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.