CVE-2026-86227: Out-of-Bounds Read in valkey-io valkey

An out-of-bounds read vulnerability (CVE-2026-86227) affects valkey-io valkey versions 9.0.0 through 9.1.1 in the kvstoreGetHashtable function. The vulnerability arises from improper handling of the didx argument, allowing an attacker with specific conditions—cluster mode enabled and control over dump.rdb at startup—to cause an out-of-bounds read. Exploitation requires local attacker capabilities such as data directory write access or the ability to provide a crafted replication feed, making remote pre-auth exploitation infeasible. The attack complexity is high, and the exploitability is difficult. The issue was closed by the maintainers as a memory safety concern but not qualifying for a security disclosure. A patch identified by commit 4691888e7fab3df128f0bde5750c9fde2ae552fa is available and recommended.

The vulnerability allows an attacker with local write access to the data directory or the ability to supply a crafted replication feed to cause an out-of-bounds read during startup in cluster mode. This can lead to a denial-of-service condition at boot time. There is no indication of remote pre-auth exploitation or privilege escalation. The CVSS score is 2.3 (medium severity), reflecting the limited exploitability and impact.

A patch is available to address this vulnerability (commit 4691888e7fab3df128f0bde5750c9fde2ae552fa). It is recommended to deploy this patch to ensure memory safety. Exploitation requires specific conditions that limit the attack surface, but patching is advised to eliminate the risk. No additional mitigations are indicated by the vendor advisory.