EUVD-2025-28478

DragonflyDB is a high-performance, drop-in Redis replacement written in C++. The vulnerability resides in the Lua struct module (src/redis/lua/struct), which handles serialization/deserialization of binary data structures within Lua scripts executed by the database engine. CWE-190 (Integer Overflow or Wraparound) occurs when arithmetic operations on integer values used for buffer size calculations, array indexing, or memory allocation lack proper bounds checking. In this context, an attacker can craft malicious Lua scripts that trigger integer wraparound during struct packing/unpacking operations, causing the calculated size to wrap around to a small value. This allows writing beyond allocated buffer boundaries or reading from unintended memory regions. The Lua execution context within DragonflyDB provides an attack surface for unauthenticated script injection if default security is misconfigured, or for authenticated users with SCRIPT LOAD/EVAL permissions.