CVE

CVE-2026-25589

View on NVD ↗

RedisBloom RESTORE invalid memory access may allow remote code execution

Exploitation IoCs 4

Package Redis 6.2.22
Package Redis 7.4.9
Package Redis 8.6.4
Package Redis 8.8.0

MITRE ATT&CK TTPs 3

T1055
Process Injection
Defense Evasion
 T1068
Exploitation for Privilege Escalation
Privilege Escalation
 T1210
Exploitation of Remote Services
Lateral Movement

Source Articles

Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say
Redis disclosed and patched multiple memory corruption vulnerabilities in its database software that could lead to authenticated remote code execution (RCE). Two distinct exploit chains were identified: one leveraging a shared-NACK use-after-free in Redis Streams, and another exploiting an out-of-bounds write in the RedisBloom TDigest RDB loader. Both vulnerabilities require the RESTORE command and were exploited in proof-of-concept (PoC) scripts to achieve arbitrary memory access and system command execution. The flaws affect multiple Redis versions, including 6.2.22, 7.4.9, 8.6.4, and 8.8.0, with fixes released on July 23, 2026.
hacker-news Jul 24, 2026