A flaw in RedisTimeSeries versions prior to 1.12.14 allows an authenticated attacker with permission to run the RESTORE command to supply a crafted serialized payload. The module does not properly validate the payload, leading to an invalid memory access that may result in remote code execution. The vulnerability is classified as a buffer overflow.

RedisTimeSeries, any Redis deployment that loads the module before version 1.12.14. The impact applies to the full server process, as the vulnerable operation runs with the Redis server's privileges.

The CVSS score of 7.7 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, so the exact likelihood of exploitation in the wild is uncertain. An attacker must authenticate and be granted the RESTORE command; once those conditions are met, the flaw can be triggered by sending a malicious payload. The genuine exploitation path requires no additional privileges beyond the RESTORE permission.