The vulnerability is a type confusion in _read_flags that occurs when the --bolt argument is parsed. A remote authenticated attacker that can run the GRAPH.QUERY command can cause a denial of service and may also disclose or corrupt memory. The attack relies on the function incorrectly casting a Redis string object to a Bolt client structure without validating its origin, leading to dereference of invalid pointers in the result‑set code. Because the argument is parsed even when bolt support is disabled, every default installation of FalkorDB older than 4.20.0 is affected.

All installations of FalkorDB with a release prior to 4.20.0 are affected. The issue is present in any configuration where GRAPH.QUERY is accessible, including default setups where the bolt endpoint is disabled but the argument is still parsed.

The CVSS score of 7.7 indicates a high impact, and although the EPSS score is not available, the vulnerability remains significant because it can be triggered by any authenticated client with GRAPH.QUERY permissions. The problem is not listed in CISA KEV, but its impact on reliability and memory consistency makes it a serious threat. The primary attack vector is remote, authenticated. The attacker needs valid Redis credentials and sufficient privileges to run GRAPH.QUERY, after which the type confusion leads to service interruption or potential memory disclosure.