Redis includes a RESTORE command that ingests serialized data structures. In versions prior to 8.6.3, the command does not properly validate the input, allowing a crafted payload to trigger an invalid memory access. This memory corruption can lead to arbitrary code execution in the context of the redis‑server process. The flaw corresponds to CWE‑122.

The vulnerability affects Redis versions released before 8.6.3. Any deployment running a Redis server earlier than the 8.6.3 release, regardless of operating system or environment, is susceptible.

The CVSS score of 7.7 indicates high severity. The EPSS score of 3% reflects a modest likelihood of exploitation when it exists. The vulnerability is not listed in CISA KEV. An attacker must be authenticated and granted permission to use the RESTORE command—typically achieved through weak or missing ACL rules. Once a malicious payload is processed, an authenticated attacker could gain remote code execution on the host running redis‑server.