DragonflyDB suffered an integer overflow in the CMS.INITBYDIM and CMS.INITBYPROB commands, where the product of the provided width, depth, and the size of an int64_t could overflow. The bug causes the code to allocate a buffer smaller than required, while CMS.INCRBY and CMS.QUERY later use the unbounded dimensions against this undersized buffer, allowing an attacker to overwrite or read adjacent heap memory. The consequence is memory corruption that can lead to disclosure of sensitive data or server crashes. The flaw falls under CWE-190: Integer Overflow or Wraparound.

The vulnerability affects DragonflyDB versions prior to 1.40.0. The affected product is DragonflyDB Dragonfly; any deployment of this in‑memory data store that has not applied the 1.40.0 release is susceptible. No other vendors or products are listed as impacted.

The CVSS score of 8.8 indicates high severity. While the EPSS score is not available, the lack of a known exploit listing in the CISA KEV catalog suggests the risk is not yet confirmed at a large scale. Nevertheless, the flaw can be triggered by an unauthenticated remote client that can send CMS.INITBYDIM or CMS.INITBYPROB requests to the server, making it a remote data‑exposure and crash vulnerability. Attackers would need network access to the Dragonfly instance and could exploit the integer overflow even if no authentication is required, as the commands are public by design.