AI-Discovered Flaw: Redis Flaw (CVE-2025-62507) Allows Remote Code Execution via Stack Buffer Overflow

According to Redis advisory, CVE-2025-62507 is a high-severity vulnerability that could allow remote code execution via a stack buffer overflow triggered by improper input handling in the XACKDEL command, which is used in stream message acknowledgment and deletion. The flaw affects Redis 8.2 and later, with the company confirming that version 8.2.3 contains the fix, and the advisory notes a CVSSv4 score of 7.7.

In practice, an attacker with access to the Redis CLI or API could exploit the bug by passing an excessively large list of IDs to XACKDEL, overwriting stack memory and potentially executing arbitrary code in the Redis process. Redis urges users to upgrade to version 8.2.3 immediately, and suggests a temporary mitigation using ACLs to restrict the XACKDEL command for those unable to patch right away. Interestingly, Google Big Sleep is credited with the discovery of CVE-2025-62507, an AI security agent developed by Google DeepMind and Project Zero.