RedisTimeSeries CVE-2026-25588

Requires authenticated access to Redis server with valid credentials (PR:L). Attacker must have explicit permission to execute RESTORE command - this is NOT granted by default in Redis ACL configurations but may exist in environments with permissive ACLs or legacy configurations using default user permissions. RedisTimeSeries module must be loaded in the Redis server instance (confirmed via 'MODULE LIST' command showing 'timeseries' module). Attack is network-based (AV:N) but has high complexity (AC:H), requiring detailed knowledge of Redis serialization protocol formats, heap memory layout, and exploitation techniques for heap buffer overflows. Successful RCE requires precise payload crafting to control heap corruption outcomes. Limiting factor: Properly configured Redis deployments using ACLs to restrict RESTORE to administrators only are not vulnerable to this attack vector, even with module loaded. Default Redis installations without ACL hardening may grant RESTORE to authenticated users, expanding attack surface.

Real-world risk is MODERATE-HIGH for environments where authenticated users have RESTORE command access. CVSS 7.7 with High impact across confidentiality, integrity, and availability accurately reflects the potential for complete system compromise, but attack complexity is High (AC:H), indicating exploitation requires specialized knowledge of Redis serialization formats and heap manipulation techniques. The PR:L requirement means any authenticated Redis user with RESTORE permissions can attempt exploitation - this is NOT a default permission in properly configured Redis deployments but may exist in development environments or misconfigured production systems. No EPSS score provided, no CISA KEV listing, and no public POC identified, suggesting limited real-world exploitation activity to date. The availability of a vendor patch (v1.12.14) and effective ACL-based workaround significantly reduces risk for organizations that can deploy controls. Priority should be HIGH for Redis instances running RedisTimeSeries with multiple authenticated users or where RESTORE command is not restricted via ACLs. Priority can be MEDIUM-LOW for single-user Redis instances or where ACLs already restrict RESTORE to administrators only. Critical consideration: Redis modules run in the same process space as Redis server, so RCE in a module equals full server compromise with access to all data across all databases.

An authenticated attacker with valid Redis credentials and RESTORE command permissions crafts a malicious serialized payload with manipulated size metadata and overflow data designed to corrupt heap memory structures. The attacker connects to the Redis server over the network and issues a RESTORE command with the crafted payload targeting a RedisTimeSeries data type. The module's deserialization routine allocates insufficient heap memory based on the manipulated metadata, then copies attacker-controlled data beyond the buffer boundary, overwriting adjacent heap structures such as malloc metadata or function pointers. By carefully structuring the overflow data, the attacker hijacks control flow to execute arbitrary code within the Redis server process, gaining full access to all Redis databases and the underlying system with Redis process privileges.