In Redis versions prior to 8.8.0, an authenticated attacker who can issue the RESTORE command can create a payload that references the same NACK (pending entry) for multiple consumers. When the attacker subsequently removes those consumers with XGROUP DELCONSUMER, the server frees the shared memory twice, creating a double free (CWE‑415) that can be leveraged to execute arbitrary code. The flaw may also involve elements of command injection (CWE‑1341) because the crafted payload can manipulate the internal command handling logic, further expanding the attack surface. The vulnerability is a direct result of an incomplete fix for CVE‑2026‑25243.

All Redis deployments running a version earlier than 8.8.0 are vulnerable, regardless of operating system or deployment style. The issue arises whenever an authenticated client can invoke RESTORE and consumer groups are in use; it is not limited to particular configurations.

The CVSS score of 7.5 reflects high severity, while the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild at the time of assessment. The vulnerability is not listed in CISA's KEV catalog, indicating no known widespread exploitation. Attackers would need valid credentials and the ability to execute RESTORE followed by XGROUP DELCONSUMER, making the attack vector application‑level and requiring specific command sequences.