CVE-2025-49844

CVE Enrichment

CVSS: 9.9 CRITICAL
EPSS: 82.29%
EPSS Percentile: 99.65%
CISA KEV: Not listed

Description

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: security-advisories@github.com
Published: 04-Oct-2025 03:15
Last Modified: 17-Jun-2026 16:32
EPSS Date: 2026-10-12
CWE: CWE-416

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

redis / redis
Version / affected range: * · before (exclusive) 6.2.20
cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*
redis / redis
Version / affected range: * · from (inclusive) 7.0 · before (exclusive) 7.2.11
cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*
redis / redis
Version / affected range: * · from (inclusive) 7.4.0 · before (exclusive) 7.4.6
cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*
redis / redis
Version / affected range: * · from (inclusive) 8.0.0 · before (exclusive) 8.0.4
cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*
redis / redis
Version / affected range: * · from (inclusive) 8.2.0 · before (exclusive) 8.2.2
cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*
lfprojects / valkey
Version / affected range: * · before (exclusive) 7.2.11
cpe:2.3:a:lfprojects:valkey:*:*:*:*:*:*:*:*
lfprojects / valkey
Version / affected range: * · from (inclusive) 8.0.0 · before (exclusive) 8.0.6
cpe:2.3:a:lfprojects:valkey:*:*:*:*:*:*:*:*
lfprojects / valkey
Version / affected range: * · from (inclusive) 8.1.0 · before (exclusive) 8.1.4
cpe:2.3:a:lfprojects:valkey:*:*:*:*:*:*:*:*

References

Last enrichment sync: 12-Oct-2026 23:24
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Last year’s competition yielded the first-ever findings under the new AI-specific category, including CVE-2025-49844 (ZDI-25-933), a critical use-after-free vulnerability in Redis, and CVE-2025-23266 (ZDI-25-626), a Pwn2Own Berlin 2026 Exposes Security Weaknesses Across AI Tools

CVE (1)

People (2)

Vendors (5)

Products (12)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.