CVE-2026-7827: Stack-based buffer overflow in FalkorDB _RdbLoadEntity via unbounded property count in crafted RDB
A stack-based buffer overflow in the RdbLoadEntity function of the RDB graph decoders (src/serializers/decoders//decodegraphentities.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service and possibly execute arbitrary code by supplying a crafted RDB stream with an attacker-controlled entity property count. The count sizes two variable-length arrays on the thread stack with no upper bound, and the decoder then fills them with attacker-supplied values.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FalkorDBto a version that resolves this vulnerability.Fixed in 4.18.4
Event History
Frequently Asked Questions
Which deployments are realistically exposed to remote exploitation?
Instances that allow an attacker to issue Redis replication commands are exposed. The advisory gives an instance with no password configured as an example of a reachable target.
What does an attacker need to provide?
The attacker needs to supply a crafted RDB stream containing an entity property count they control. Exploitation relies on that unbounded count sizing stack-based variable-length arrays, followed by attacker-supplied values being decoded into them.
Which versions are affected and what is the remediation?
FalkorDB versions before 4.18.4 are affected. Upgrade to 4.18.4 or later.
What is the impact if exploitation succeeds?
Successful exploitation can cause a denial of service and may allow arbitrary code execution. The affected decoder processes the crafted RDB data on the thread stack.