Redis-server up to version 8.6.3 contains a vulnerability (CVE-2026-25243) in the RESTORE command where serialized values are not properly validated. An authenticated attacker with RESTORE command permissions can supply a crafted serialized payload causing invalid memory access, which may lead to remote code execution. This vulnerability is classified under CWE-122 (Heap-based Buffer Overflow). The issue affects keydb versions: all versions less than 6.2.22, versions from 7.0.0 up to but not including 7.2.14, 7.3.0 up to but not including 7.4.9, 8.0.0 up to but not including 8.2.6, and 8.3.0 up to but not including 8.4.3. The vulnerability is patched in redis-server version 8.6.3 and corresponding keydb versions. Red Hat has issued security advisories and updates for affected Red Hat Enterprise Linux versions. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to remote code execution by an authenticated attacker with permission to execute the RESTORE command. This could allow an attacker to execute arbitrary code on the affected system, potentially leading to full system compromise. The vulnerability affects multiple versions of keydb and redis-server prior to the patched versions. No known active exploitation has been reported.

An official patch is available and should be applied to upgrade redis-server to version 8.6.3 or later, or the corresponding fixed keydb versions. Alternatively, restricting access to the RESTORE command via Access Control List (ACL) rules can mitigate the risk by preventing unauthorized use of the vulnerable command. Red Hat provides updated packages and advisories for affected Enterprise Linux versions. Users should follow vendor guidance to apply these updates promptly.