CVE-2026-92925 describes a flaw in Redis community edition where the cluster bus packet parser does not properly validate null-termination of string-carrying extensions in packets such as PING, PONG, and MEET. This improper validation enables a remote attacker to craft malicious packets that trigger an out-of-bounds read during payload processing. The vulnerability can result in disclosure of sensitive information or cause a remote denial of service condition.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information or cause a remote denial of service (DoS) in affected Redis community versions. The CVSS 3.1 base score is 7.1 with vector AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, indicating that the attack requires adjacent network access, has low complexity, no privileges or user interaction, impacts confidentiality partially, and causes high impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor vendor advisories for updates and consider restricting access to the Redis cluster bus interface to trusted networks to reduce exposure.