Redis Server Use-After-Free Vulnerability Allows Remote Code Execution

A critical security vulnerability has been discovered in Redis Server that could allow authenticated attackers to achieve remote code execution through a use-after-free flaw in the Lua scripting engine. According to Wiz, including Benny Isaacs, Nir Brakha, and Sagi Tzadik working with Trend Micro’s Zero Day Initiative, the flaw affects all versions of Redis that support Lua scripting functionality and is tracked as CVE-2025-49844.

The vulnerability stems from an improper memory management in Redis’s Lua scripting implementation, where memory references can persist after the garbage collector has freed the memory, enabling attackers to craft malicious Lua scripts that manipulate the garbage collector and trigger a use-after-free condition. The CVSS 3.1 score is 10.0, with remote code execution possible for those with valid Redis credentials over network connections, and exploitation is described as low complexity. As a temporary defence, the article recommends restricting EVAL and EVALSHA via ACLs to prevent Lua script execution, while patches remain TBD.