Valkey’s RESTORE command can accept a malformed RDB stream that assigns one Pending Entry List NACK to multiple consumers during stream consumer‑group deserialization. When a consumer is deleted while another still references the shared NACK, a use‑after‑free occurs, potentially allowing an attacker to trigger remote code execution. This is a classic use‑after‑free flaw (CWE‑416) that may also be leveraged through the exploitation technique identified by CWE‑825.

The vulnerability affects the Valkey key‑value database from the Valkey‑IO organization. Versions older than 7.2.14, 8.0.10, 8.1.9, 9.0.5 and 9.1.1 are impacted; the fix was applied in those release points and subsequent versions. All earlier releases remain vulnerable.

The CVSS score of 8.8 indicates high severity. The exploit can be performed over the network by sending a crafted RESTORE command to a reachable Valkey instance. The EPSS score of less than 1% indicates a low but nonzero exploitation probability, and this issue is not listed in the CISA KEV catalog. Because the attack vector is remote and the impact is arbitrary code execution, operators should treat the vulnerability as a security priority requiring prompt remediation.