Redis versions starting from 7.0.0 to before 8.0.2 contain a stack-based buffer overflow vulnerability in the redis-check-aof utility. The vulnerability arises from the use of memcpy with strlen(filepath) to copy a user-supplied file path into a fixed-size stack buffer, which can overflow the stack. This overflow could allow an attacker to execute arbitrary code. The vulnerability is tracked as CVE-2025-27151 and has been patched in Redis version 8.0.2. Red Hat Product Security has released advisories and updates addressing this issue in their valkey package for Red Hat Enterprise Linux 10 and related variants. No known exploits in the wild have been reported.

The vulnerability allows an attacker to cause a stack overflow in redis-check-aof, which may lead to remote code execution. This could compromise the affected system by allowing arbitrary code execution with the privileges of the redis-check-aof process. The issue affects Redis installations using vulnerable versions and could impact systems relying on redis-check-aof for AOF file checking and repair.

An official patch is available and has been released in Redis version 8.0.2. Users should upgrade to version 8.0.2 or later to remediate this vulnerability. Red Hat has provided updated valkey packages for Red Hat Enterprise Linux 10 and related distributions; applying these updates will mitigate the issue. No additional mitigation steps are required beyond applying the official updates.