CVE-2026-46752 is a heap-based buffer overflow vulnerability (CWE-122) in the cjson library component of Apache Kvrocks, affecting Redis Lua operations. The flaw exists in versions 2.0.4 through 2.15.0 and can lead to severe consequences given its critical CVSS 10.0 rating. The vulnerability allows an attacker to potentially execute arbitrary code or cause a denial of service due to memory corruption. The issue is fixed in Apache Kvrocks version 2.16.0.

The vulnerability has a CVSS 4.0 base score of 10.0, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, availability, and security requirements. Exploitation could result in arbitrary code execution or service disruption via heap memory corruption in the Redis Lua environment of Apache Kvrocks.

Users should upgrade Apache Kvrocks to version 2.16.0 or later, where this heap-based buffer overflow vulnerability in the cjson library has been fixed. No other remediation or temporary mitigations are indicated. Patch status is confirmed by the recommendation to upgrade to 2.16.0.