FalkorDB EUVD-2026-95474

Exploitation requires the attacker to be able to issue Redis replication commands (e.g., REPLICAOF/SLAVEOF) so the FalkorDB instance loads an attacker-supplied RDB stream whose entity property count is attacker-controlled and unbounded; the decoder (_RdbLoadEntity in src/serializers/decoders/*/decode_graph_entities.c) then sizes two variable-length thread-stack arrays from that count and fills them, overflowing the stack. The concrete enabling condition named in the description is an instance with NO password configured (requirepass/ACL unset) that is network-reachable, which makes the replication commands unauthenticated. LIMITING FACTORS: if a password or ACLs are configured the attacker needs valid credentials to initiate replication; reliable arbitrary code execution (versus DoS) is non-trivial given stack overflow exploitation and corresponds to the CVSS AC:H rating; only versions before 4.18.4 are affected.

Signals point to a genuinely serious but not yet actively-exploited flaw whose real-world urgency is bounded by deployment context. The vendor-assigned CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) yields 9.2 Critical, driven by network reach, no required privileges, and high confidentiality/integrity/availability impact; AC:H appropriately reflects that an attacker must stand up a replication master and craft a malformed RDB stream, and for code execution must defeat stack layout/mitigations. PR:N is defensible ONLY for the stated no-password scenario - against a FalkorDB/Redis instance with requirepass or ACLs set, replication commands require credentials, so effective privilege rises. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so exploitation status is 'no public exploit identified at time of analysis' - there is no evidence of in-the-wild use. The root cause is firmly confirmed by the vendor source diff (variable-length stack arrays sized by an unbounded attacker-controlled count, now capped at UINT16_MAX with a 256-element stack threshold and a heap path). Net: this is a real priority for anyone exposing an unauthenticated FalkorDB instance to untrusted networks, where DoS is trivially achievable, but RCE remains the description's 'possibly' (not demonstrated) and the niche product footprint plus AC:H temper the likelihood of mass exploitation versus targeted abuse of misconfigured, internet-exposed instances.

An attacker who can reach a FalkorDB instance that has no password configured issues Redis replication commands (e.g., REPLICAOF/SLAVEOF) pointing the victim at an attacker-controlled master, then serves a crafted RDB stream declaring a huge entity property count. When _RdbLoadEntity sizes two variable-length stack arrays from that unbounded count and fills them with attacker data, the thread stack is overrun, reliably crashing the service (DoS) and possibly enabling arbitrary code execution. No public exploit code was identified in the provided data, and the network vector is tempered by AC:H (crafting the RDB and achieving reliable RCE is non-trivial).