CVE-2026-86227: Out-of-Bounds Read in valkey-io valkey

An out-of-bounds read vulnerability (CVE-2026-86227) affects valkey-io valkey versions 9.0.0 through 9.1.1 in the kvstoreGetHashtable function of src/kvstore.c. The vulnerability arises from manipulation of the argument didx, leading to an out-of-bounds read. Exploitation requires cluster mode and an attacker-controlled dump.rdb file at startup, implying the attacker must have write access to the data directory or replication feed. The attack complexity is high, and exploitability is difficult. The vulnerability is primarily a memory safety issue and was closed by the maintainers as not meeting their bar for security disclosure. A patch identified by commit 4691888e7fab3df128f0bde5750c9fde2ae552fa is recommended to fix the issue.

The vulnerability allows an out-of-bounds read which could potentially lead to memory safety issues. However, exploitation requires specific conditions including cluster mode and attacker-controlled dump.rdb at startup, limiting the attack surface. The CVSS score of 2.3 reflects low severity, indicating limited impact. There is no indication of remote code execution or privilege escalation. The exploitability is considered difficult and no known exploits in the wild have been reported.

A patch identified by commit 4691888e7fab3df128f0bde5750c9fde2ae552fa is recommended to remediate this vulnerability. Since the vulnerability requires attacker-controlled dump.rdb at startup and cluster mode, restricting write access to the data directory and replication feeds can reduce risk. The issue was closed by the maintainers as not meeting their security disclosure threshold but fixing it is advised for memory safety. Patch status is not explicitly confirmed by a vendor advisory; users should verify with official valkey-io sources for the latest remediation guidance.