Redis (<8.2.2): Use-After-Free in Redis Lua scripting leading to remote code execution (CVE-2025-49844) #shorts

Summary

Welcome to today’s podcast. We’re diving into CVE-2025-49844, a critical remote code execution vulnerability in Redis. Discovered by Wiz Research and tracked by CERT, this flaw affects all Redis servers with Lua scripting enabled prior to version 8.2.2. It’s estimated to expose roughly 75% of cloud environments to potential attacks, making it one of the most impactful Redis vulnerabilities in recent memory.

Product details

Redis is a popular open source, in-memory data store that persists datasets on disk. It’s widely adopted across enterprises, cloud providers, and DevOps teams for caching, message brokering, and real-time analytics. Oracle Linux 10, Rocky Linux 8, and countless other distributions have pushed security updates specifically to address this vulnerability, highlighting its severity and broad footprint.

Vulnerability type summary

CVE-2025-49844 is classified under CWE-416: Use After Free. In a nutshell, a use-after-free bug allows an attacker to trigger a reference to memory that has already been released. When exploited correctly, this can lead to arbitrary code execution, privilege escalation, and complete system compromise.

Details of the vulnerability

In versions of Redis up to 8.2.1, an authenticated user can supply a specially crafted Lua script that manipulates the internal garbage collector. By abusing Redis’s Lua scripting engine—specifically the EVAL and EVALSHA commands—a malicious actor can force a use-after-free condition. Once triggered, this flaw can be chained into remote code execution on the host system. CERT and Redis maintainers confirmed the issue on October 3, 2025, and released the patch in version 8.2.2 on October 8. Until you can upgrade, you can mitigate risk by enforcing ACL rules to disable Lua scripts—blocking EVAL and EVALSHA altogether.

Conclusion

CVE-2025-49844 serves as a stark reminder of the power and danger of embedded scripting engines. If you manage Redis instances, especially in cloud deployments, apply version 8.2.2 or later immediately. Review your ACL policies to ensure Lua scripting is restricted according to the principle of least privilege. Stay tuned for future episodes where we’ll unpack the latest security updates and dive deeper into hardening your infrastructure.

Watch the full video on YouTube: CVE-2025-49844

Remediation and exploitation details

This chain involves the following actors

  • Attacker: authenticated or unauthorized user seeking remote code execution

This following systems are involved

  • Redis Server (in-memory key value data store with script evaluation): target of memory corruption and code execution

Attack entry point

  • EVAL/EVALSHA commands: interface that accepts and runs user-supplied Lua scripts

Remediation actions

System Administrator
Upgrade the Redis server to version 8.2.2 or later
Redis Server
System Administrator
Restrict the EVAL and EVALSHA commands using access control lists
Redis Server
System Administrator
Disable the Lua scripting feature if it is not required
Redis Server

Exploitation actions

Use valid credentials or exploit lax access controls

Attacker
Establish a connection and authenticate to the Redis instance
Redis Server
Examples:
  • Logging in with breached or default password via redis-cli

Invoke functions in a sequence that frees objects prematurely

Attacker
Send a specially crafted Lua script that abuses the memory garbage collector
Redis Server
Examples:
  • EVAL 'for i=1,1000 do collectgarbage("step") end' 0

Manipulate object lifecycle so memory is reused while still referenced

Attacker
Trigger a use-after-free by keeping references to freed objects
Redis Server
Examples:
  • Repeatedly allocate and free tables in the Lua environment

Embed binary payload inside the Lua script to place shellcode

Attacker
Overwrite the freed memory region with malicious machine code
Redis Server
Examples:
  • Crafting a payload that writes raw bytes into freed memory slots

Corrupt function pointers or return addresses in server process

Attacker
Redirect execution flow to the injected shellcode
Redis Server
Examples:
  • Modifying Lua internal dispatch table entries to point to shellcode

Run the shellcode to spawn a command shell or connect back

Attacker
Execute arbitrary operating system commands
Redis Server
Examples:
  • Reverse shell connecting to attacker controlled host on port 4444

Use operating system utilities to copy database files or install backdoor

Attacker
Exfiltrate sensitive data and maintain persistence
Redis Server
Examples:
  • Uploading dump files to remote storage or installing cron job

Related Content

NOTE: The following related content has not been vetted and may be unsafe.

CVE database technical details

CVE ID
CVE-2025-49844
Description
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
Provider
GitHub_M
CWE / problem types
CWE-416: Use After Free
Affected Software Versions
redis:redis:[{'version': '< 8.2.2', 'status': 'affected'}]
Date Published
2025-10-03T19:27:23.609Z
Last Updated
2025-10-08T03:55:16.159Z