#VU109874 Stack-based buffer overflow in Redis - CVE-2025-27151

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when parsing file names. A remote attacker can trick the victim into passing an overly long file path to the redis-check-aof cli, trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation

External links

• https://github.com/redis/redis/security/advisories/GHSA-5453-q98w-cmvm
• https://github.com/redis/redis/releases/tag/8.0.2
• https://github.com/redis/redis/releases/tag/7.4.4
• https://github.com/redis/redis/releases/tag/7.2.9