PoC Exploit Released for Critical Vulnerabilities in Lua Engine

A PoC exploit has been released for three critical vulnerabilities in the Lua engine used by Redis 7.4.5, with attackers able to trigger remote code execution and privilege escalation by abusing flaws in the Lua parser, the unpack() function, and protection of basic type metatables. The issues were found during a routine audit of Redis 7.4.5 and pose a direct threat to systems that allow untrusted scripts via the EVAL command, prompting immediate patching.

The flaws are CVE-2025-49844 (use-after-free in the Lua parser), CVE-2025-46817 (integer overflow in unpack()), and CVE-2025-46818 (metatable privilege escalation), each with a CVSS score of 9.8 and requiring EVAL access. A complete Python PoC tests all three flaws against a live Redis server, including scenarios that force garbage collection during parsing, trigger the unpack() overflow, and attempts to modify basic metatables.

Organisations should upgrade to Redis 7.4.6 or later, which adds stack protection, bounds checks, and readonly enforcement on basic metatables, according to redrays[.]io.