Redis, as an in-memory data store, includes a RESTORE command that allows reloading serialized data structures. In versions prior to 8.6.3 the command does not fully validate the incoming serialized payload, which can cause an invalid memory access. The vulnerability is a classic memory corruption flaw corresponding to CWE‑122. Execution of a crafted payload has the potential to lead to arbitrary code execution in the context of the redis‑server process.

The affected product is Redis running on the redis:redis platform. Versions up to and including 8.6.2 are impacted, and the fix was incorporated in the 8.6.3 release. Any deployment using an earlier release is therefore vulnerable.

The CVSS score of 7.7 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Attackers must be authenticated and possess permission to invoke the RESTORE command, typically through ACL misconfiguration or because the command is not restricted. Once a crafted payload is processed, the memory corruption can yield remote code execution on the host running redis‑server.