ZDI-25-933: (Pwn2Own) Redis Lua Use-After-Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Redis. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2025-49844.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-25-933?
The severity of ZDI-25-933 has been rated as 9.8 on the CVSS scale, indicating critical vulnerability.
What impact does ZDI-25-933 have on Redis installations?
ZDI-25-933 allows remote attackers to execute arbitrary code on affected Redis installations without requiring authentication.
How can I fix ZDI-25-933?
To fix ZDI-25-933, upgrade your Redis installation to the latest version, which includes security patches addressing this vulnerability.
Is authentication required to exploit ZDI-25-933?
No, ZDI-25-933 can be exploited by remote attackers without any authentication required.
Which versions of Redis are affected by ZDI-25-933?
ZDI-25-933 affects all installations of Redis that have not been patched against this vulnerability.