A double free condition exists in the moduleTimerHandler function of Valkey’s Module Timer subsystem, specifically in the 9.1.0 release. This flaw can allow an attacker to trigger a second deallocation of memory that has already been freed, resulting in undefined behavior that may be leveraged for arbitrary code execution or forced application termination. The vulnerability is caused by improper memory management after a timer event is processed.

Valkey-io Valkey version 9.1.0. No other versions are listed, and the patch that resolves the flaw corresponds to commit b349fe2821e3998534b1454c1b64a478daf8c6b7 on the project’s GitHub repository.

The vulnerability has a CVSS score of 4.8, indicating moderate severity. EPSS information is unavailable, and the flaw is not yet catalogued in the CISA KEV list. The attack can be initiated remotely, as the vulnerability is triggered by external input to the timer subsystem. Exploitation requires the ability to invoke the moduleTimerHandler through the exposed interfaces, and once executed it could compromise the confidentiality, integrity, or availability of the affected server.