FalkorDB CVE-2026-7826

Exploitation requires the attacker to be able to drive a Redis replication exchange against the FalkorDB instance - for example by acting as a replication master or issuing replication commands - and supply a malicious RDB stream in which the sub-buffer length field in BufferSerializerIOv2_ReadBuffer exceeds the remaining buffer size. The primary enabling condition is an instance reachable on the network with no password (no requirepass/ACL), as the description explicitly cites; the flaw is reachable only because the bounds check is an ASSERT() stripped from release builds. Limiting factors: instances configured with authentication require valid credentials (removing the unauthenticated path), network isolation or firewalling of the replication port prevents reach, and only FalkorDB versions before 4.18.4 are affected - upgrading restores proper runtime length validation.

This is a genuine, exploitable network-facing flaw rather than an inflated high-CVSS issue, but its real-world priority hinges on exposure. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H) indicates a low-complexity, remote, unauthenticated attack yielding high confidentiality (heap disclosure) and high availability (DoS) impact - consistent with the description. The PR:N rating is accurate only for the common no-password deployment the description calls out; an instance protected with requirepass/ACL effectively raises the privilege bar, so the practical attack surface is narrower than PR:N alone suggests. No EPSS score was provided, the CVE is not in CISA KEV, and no public exploit is referenced, so there is no evidence of active exploitation - this is a patch-promptly item, not a drop-everything emergency. The root cause is well-corroborated by the vendor patch (the sole bounds check was an ASSERT() compiled out of release builds, letting memcpy() over-read), which raises confidence in the technical claim. Net assessment: credible high-severity bug, moderate-to-high urgency for anyone running FalkorDB exposed to untrusted replication traffic, lower urgency where instances are authenticated and network-isolated.

An attacker who can reach a FalkorDB instance with no password configured initiates a Redis replication exchange and feeds a crafted RDB stream whose sub-buffer length field is larger than the bytes actually remaining in the buffer. Because the only length validation was an ASSERT() stripped from release builds, memcpy() reads past the end of the heap allocation, either crashing the process (DoS) or copying adjacent heap memory into the returned buffer (information disclosure). No public proof-of-concept is referenced, but the vendor patch clearly documents the vulnerable path.