ZDI-26-833: Valkey clusterCreatePublishMsgBlock Numeric Truncation Error Remote Code Execution Vulnerability
Published Oct 28, 2026
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Valkey. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8.
Affected Software
1 affected component
Valkey Valkey
Event History
Oct 28, 2026
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
Who can exploit this issue?
An attacker must be authenticated to exploit the vulnerability. The provided information does not identify any additional network, privilege, or configuration prerequisites.
2
What is the potential impact if exploitation succeeds?
A successful attacker can execute arbitrary code on an affected Valkey installation. ZDI assigned the issue a CVSS rating of 8.8.