Do Son 
TL;DR: A public proof-of-concept now targets CVE-2026-66373, a Redis RCE flaw in the RESTORE command. The double-free bug lets an authenticated attacker corrupt memory and run code. Redis fixed it in version 8.8.0.
- CVE: CVE-2026-66373
- CVSS: 7.5 (High · CVSSv3)
- Product: Redis
- Affected: < 8.8.0
- Impact: CWE-415
- Status: No confirmed exploitation yet
- Patched in: 8.8.0
- EPSS: 0.5% (30-day)
- Action: Update to 8.8.0 now
Why This Redis RCE Matters
The flaw carries a CVSS score of 7.5. Successful exploitation runs code inside the Redis server process. Therefore, an attacker could reach stored data, credentials, and connected services.
Notably, this bug stems from an incomplete fix for CVE-2026-25243. The earlier patch did not fully close the RESTORE memory-corruption path, so the same class of attack returned.
How the Attack Works
The bug lives in Redis Streams. A crafted RESTORE payload makes two consumers point to the same pending-entry record, known as a NACK. Deleting both consumers with XGROUP DELCONSUMER then frees the same object twice.
That double free corrupts the heap. From there, the published script builds read and write access and calls system(). However, the attacker must already hold RESTORE permission, which is an unusual grant.
Public Disclosure and Exploit Status
Both the vulnerability details and the working exploit code are now open. The researcher shared the findings on X, and the corresponding fix appears in the code changes for Redis 8.8.0. As of late July 2026, no in-the-wild exploitation has been confirmed.
Affected Versions and Patch
All Redis releases before 8.8.0 are affected. Operators should upgrade to Redis 8.8.0, which is the only complete fix. Until they patch, teams should restrict RESTORE access and limit network exposure with strong authentication.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
