An authenticated attacker who can run Lua scripts in redis-server can trigger a use‑after‑free during the master‑replica synchronization process on replicas where replica‑read‑only is not enforced. The vulnerability allows the attacker to execute arbitrary code on the replica host, resulting in remote code execution. The flaw is a classic use‑after‑free (CWE‑416) that undermines the integrity of replica memory. Its exploitation requires the attacker to have sufficient credentials to run scripts and to influence the synchronization flow.

All redis‑server versions that include Lua support prior to version 8.6.3 run the vulnerable code. The issue manifests when replicas have replica‑read‑only disabled or can be disabled, allowing the use‑after‑free to be reached. Any deployment that uses replicas without the read‑only safeguard and permits authenticated Lua execution is affected.

The CVSS score is 6.1, indicating moderate severity. No EPSS data is available, and the vulnerability is not listed in CISA KEV. The exploit path requires authentication and Lua scripting ability, implying that the attacker must have at least internal or privileged access. Once the use‑after‑free is triggered via replication, the attacker can run arbitrary code on the replica, controlling that host.