CVE-2025-27151: redis-check-aof may lead to stack overflow and potential RCE
Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27151?
CVE-2025-27151 has been classified as a high severity vulnerability due to the potential for stack-based buffer overflow.
How do I fix CVE-2025-27151?
To mitigate CVE-2025-27151, upgrade Redis to version 8.0.2 or later, where the vulnerability has been resolved.
Which versions of Redis are affected by CVE-2025-27151?
CVE-2025-27151 affects Redis versions from 7.0.0 to before 8.0.2.
What is the impact of CVE-2025-27151 on Redis users?
The impact of CVE-2025-27151 can lead to potential exploitation, allowing attackers to execute arbitrary code on the system.
Is there a workaround for CVE-2025-27151 if I can't upgrade Redis?
There are no known workarounds for CVE-2025-27151, and upgrading to a secure version is strongly recommended.