Redis Multiple Versions RCE Analysis (CVE-2026-25243/25589) and POC Exploits

Vulnerability Overview This page describes a Remote Code Execution (RCE) vulnerability in Redis, specifically involving bugs in the stream NACK double free, TDigest, and TopK modules. These vulnerabilities allow attackers to execute arbitrary code in specific versions of Redis. Affected Versions Affected Versions: Redis 6.2.22, 7.4.9, 8.6.4, 8.8.0 Vulnerability Types: - Stream NACK double free - TDigest heap overflow - TopK wild free Remediation Patch Information: - Version 8.6.4 patched CVE-2026-25243 via the TDigest heap overflow fix. - Version 8.8.1 patched CVE-2026-25589 via the TopK wild free fix. POC Code Below is an excerpt of the POC code: Usage Examples Target Requirements 6.2.22: Official image offset set by default. For other builds, override offsets (--str-format-off, etc.; see --help). 7.4.9 / 8.6.4 / 8.8.0 / 8.8.1: Use official images; debug flags are not required. 8.8.0/8.8.1 exploits: Sensitive to layout. Both TDigest hallway and TopK wild free rely on jemalloc layout—use fresh instances with no other clients/commands interleaved, and retry on grooming misses. Notes Post-run residue: Intentional residue (lazy), a set of exploit keys keeping double-free blocks alive; see details in . The 8.8.0 exploit leaves approximately 2000 zeroed tdigest structs + one corrupted oracle key—do not execute FLUSHALL/SAVE afterwards. Shared NACK double free: Only fixed in 8.8.0 (PR #15081); the 8.8.0 exploit uses a separate, unpatched bundled module bug. Patch bypasses demonstrated: Shared NACK variant bypasses the CVE-2026-25243 fix; TopK wild free bypasses the CVE-2026-25589 fix (partial pointer zeroing — TopK_Destroy still reads all x pointers to uninitialized heap, in RedisBloom v8.0 and v8.2). Reliability: Verified in 6.2.22 (10/10), 7.4.9 (5/5), 8.6.4 (25/25), 8.8.0 (5/5) in new containers. Aborts clearly on failure; re-run or use wrappers. Authorized Testing For authorized testing only.

Goal Reached Thanks to every supporter — we hit 100%!

Redis Multiple Versions RCE Analysis (CVE-2026-25243/25589) and POC Exploits

More from this source