Redis RCE Exposed: Researchers Detail Exploit for “Simple” Stack Overflow in Official Containers

Security researchers from JFrog Security Research have publicly disclosed a complete exploit chain for Redis CVE-2025-62507, a high-severity flaw affecting Redis versions 8.2.0 through 8.2.2 with a CVSS of 8.8. The vulnerability sits in the XACKDEL command, where an insufficient boundary check allows an attacker to overflow a stack-allocated array by supplying more message IDs than it can hold, enabling overwrite of the function’s return address.

The researchers found that the official Redis Docker image is compiled without stack canary protections, turning an otherwise difficult exploit into a straightforward one, and they constructed a Return-Oriented Programming chain to bypass NX using mprotect before running their shellcode. Demonstrations used an XGROUP CREATE followed by an XACKDEL with 62 crafted IDs to trigger a reverse shell, and the exploit is now fixed in Redis version 8.3.2.

Despite the fix, shodan scans show nearly 3,000 servers running vulnerable versions, mostly in Germany, the United States and China, with Redis not enforcing authentication by default, making unauthenticated remote code execution a real risk.