Description
A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: b349fe2821e3998534b1454c1b64a478daf8c6b7. To fix this issue, it is recommended to deploy a patch.
Published: 2026-08-31
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote exploitation of a double free vulnerability leading to potential arbitrary code execution or application crash
Action: Apply Patch
AI Analysis

Impact

A double free condition exists in the moduleTimerHandler function of Valkey’s Module Timer subsystem, specifically in the 9.1.0 release. This flaw can allow an attacker to trigger a second deallocation of memory that has already been freed, resulting in undefined behavior that may be leveraged for arbitrary code execution or forced application termination. The vulnerability is caused by improper memory management after a timer event is processed.

Affected Systems

Valkey-io Valkey version 9.1.0. No other versions are listed, and the patch that resolves the flaw corresponds to commit b349fe2821e3998534b1454c1b64a478daf8c6b7 on the project’s GitHub repository.

Risk and Exploitability

The vulnerability has a CVSS score of 4.8, indicating moderate severity. EPSS information is unavailable, and the flaw is not yet catalogued in the CISA KEV list. The attack can be initiated remotely, as the vulnerability is triggered by external input to the timer subsystem. Exploitation requires the ability to invoke the moduleTimerHandler through the exposed interfaces, and once executed it could compromise the confidentiality, integrity, or availability of the affected server.

Generated by OpenCVE AI on August 31, 2026 at 11:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Valkey to the patched commit b349fe2821e3998534b1454c1b64a478daf8c6b7 for version 9.1.0 or install any newer release that incorporates the fix
  • If a patch cannot be applied immediately, disable or remove the Module Timer subsystem or the specific modules that rely on it to prevent the double free trigger
  • Restart the Valkey service after the patch or configuration change to ensure the updated code is in use

Generated by OpenCVE AI on August 31, 2026 at 11:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1341
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 31 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 31 Aug 2026 10:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: b349fe2821e3998534b1454c1b64a478daf8c6b7. To fix this issue, it is recommended to deploy a patch.
Title valkey-io valkey Module Timer module.c moduleTimerHandler double free
First Time appeared Valkey-io
Valkey-io valkey
Weaknesses CWE-119
CWE-415
CPEs cpe:2.3:a:valkey-io:valkey:*:*:*:*:*:*:*:*
Vendors & Products Valkey-io
Valkey-io valkey
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:N/AC:L/Au:M/C:N/I:N/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 2.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 2.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Valkey-io Valkey
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-31T15:09:07.620Z

Reserved: 2026-08-30T16:36:08.965Z

Link: CVE-2026-82677

cve-icon Vulnrichment

Updated: 2026-08-31T15:08:39.505Z

cve-icon NVD

Status : Deferred

Published: 2026-08-31T10:16:50.780

Modified: 2026-08-31T20:56:08.800

Link: CVE-2026-82677

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-31T10:00:15Z

Links: CVE-2026-82677 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T11:30:05Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-1341

    Multiple Releases of Same Resource or Handle

  • CWE-415

    Double Free