CVE-2026-7826 (GCVE-0-2026-7826)
Vulnerability from cvelistv5
Published
2026-10-09 04:04
Modified
2026-10-15 15:47
Severity ?
8.8 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CWE
Summary
A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializer_io.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or disclose heap memory by supplying a crafted RDB stream whose sub-buffer length field exceeds the remaining buffer size. The only bounds check is an ASSERT(), which is compiled out in release builds, so memcpy() reads past the end of the heap allocation.
References
Impacted products
Vendor Product Version
FalkorDB FalkorDB Version: 0   ≤
    cpe:2.3:a:falkordb:falkordb:*:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-7826",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T15:47:45.659408Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T15:47:58.390Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/FalkorDB/FalkorDB",
          "cpes": [
            "cpe:2.3:a:falkordb:falkordb:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "RDB serializer / graph decoder"
          ],
          "product": "FalkorDB",
          "programFiles": [
            "src/serializers/serializer_io.c"
          ],
          "programRoutines": [
            {
              "name": "BufferSerializerIOv2_ReadBuffer"
            }
          ],
          "repo": "https://github.com/FalkorDB/FalkorDB",
          "vendor": "FalkorDB",
          "versions": [
            {
              "lessThan": "4.18.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Arjun Basnet from Securin"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializer_io.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or disclose heap memory by supplying a crafted RDB stream whose sub-buffer length field exceeds the remaining buffer size. The only bounds check is an ASSERT(), which is compiled out in release builds, so memcpy() reads past the end of the heap allocation."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-540",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-540 Overread Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T04:04:30.130Z",
        "orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
        "shortName": "securin"
      },
      "references": [
        {
          "name": "FalkorDB PR #1972",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FalkorDB/FalkorDB/pull/1972"
        },
        {
          "name": "Fix commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FalkorDB/FalkorDB/commit/55d986f45ecd5d80f7a9e5e138e8b0f96535b48c"
        },
        {
          "name": "FalkorDB 4.18.4 release notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/FalkorDB/FalkorDB/releases/tag/v4.18.4"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade FalkorDB to version 4.18.4 or later."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-24T00:00:00.000Z",
          "value": "Reported to FalkorDB"
        },
        {
          "lang": "en",
          "time": "2026-05-05T00:00:00.000Z",
          "value": "CVE ID shared with the vendor"
        },
        {
          "lang": "en",
          "time": "2026-05-07T00:00:00.000Z",
          "value": "Fix merged by the vendor (PR #1972)"
        },
        {
          "lang": "en",
          "time": "2026-05-07T00:00:00.000Z",
          "value": "FalkorDB 4.18.4 released with the fix"
        }
      ],
      "title": "Heap out-of-bounds read in FalkorDB BufferSerializerIOv2_ReadBuffer via crafted RDB",
      "workarounds": [
        {
          "lang": "en",
          "value": "Require authentication on the Redis/FalkorDB instance (requirepass or ACLs), restrict or rename the REPLICAOF/SLAVEOF commands so untrusted clients cannot use them, and do not expose the instance to untrusted networks."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
    "assignerShortName": "securin",
    "cveId": "CVE-2026-7826",
    "datePublished": "2026-10-09T04:04:30.130Z",
    "dateReserved": "2026-05-05T02:50:40.051Z",
    "dateUpdated": "2026-10-15T15:47:58.390Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Heap out-of-bounds read in FalkorDB BufferSerializerIOv2_ReadBuffer via crafted RDB\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializer_io.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or disclose heap memory by supplying a crafted RDB stream whose sub-buffer length field exceeds the remaining buffer size. The only bounds check is an ASSERT(), which is compiled out in release builds, so memcpy() reads past the end of the heap allocation.\"}], \"affected\": [{\"vendor\": \"FalkorDB\", \"product\": \"FalkorDB\", \"collectionURL\": \"https://github.com/FalkorDB/FalkorDB\", \"repo\": \"https://github.com/FalkorDB/FalkorDB\", \"modules\": [\"RDB serializer / graph decoder\"], \"programFiles\": [\"src/serializers/serializer_io.c\"], \"programRoutines\": [{\"name\": \"BufferSerializerIOv2_ReadBuffer\"}], \"cpes\": [\"cpe:2.3:a:falkordb:falkordb:*:*:*:*:*:*:*:*\"], \"defaultStatus\": \"unaffected\", \"versions\": [{\"version\": \"0\", \"lessThan\": \"4.18.4\", \"status\": \"affected\", \"versionType\": \"semver\"}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125 Out-of-bounds Read\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}], \"cvssV4_0\": {\"version\": \"4.0\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\"}}, {\"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}], \"cvssV3_1\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\", \"baseScore\": 9.1, \"baseSeverity\": \"CRITICAL\"}}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Upgrade FalkorDB to version 4.18.4 or later.\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Require authentication on the Redis/FalkorDB instance (requirepass or ACLs), restrict or rename the REPLICAOF/SLAVEOF commands so untrusted clients cannot use them, and do not expose the instance to untrusted networks.\"}], \"references\": [{\"url\": \"https://github.com/FalkorDB/FalkorDB/pull/1972\", \"name\": \"FalkorDB PR #1972\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/FalkorDB/FalkorDB/commit/55d986f45ecd5d80f7a9e5e138e8b0f96535b48c\", \"name\": \"Fix commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/FalkorDB/FalkorDB/releases/tag/v4.18.4\", \"name\": \"FalkorDB 4.18.4 release notes\", \"tags\": [\"release-notes\"]}], \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Arjun Basnet from Securin\"}], \"timeline\": [{\"time\": \"2026-04-24T00:00:00.000Z\", \"lang\": \"en\", \"value\": \"Reported to FalkorDB\"}, {\"time\": \"2026-05-05T00:00:00.000Z\", \"lang\": \"en\", \"value\": \"CVE ID shared with the vendor\"}, {\"time\": \"2026-05-07T00:00:00.000Z\", \"lang\": \"en\", \"value\": \"Fix merged by the vendor (PR #1972)\"}, {\"time\": \"2026-05-07T00:00:00.000Z\", \"lang\": \"en\", \"value\": \"FalkorDB 4.18.4 released with the fix\"}], \"source\": {\"discovery\": \"EXTERNAL\"}, \"impacts\": [{\"capecId\": \"CAPEC-540\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-540 Overread Buffers\"}]}], \"providerMetadata\": {\"orgId\": \"33c584b5-0579-4c06-b2a0-8d8329fcab9c\", \"shortName\": \"securin\", \"dateUpdated\": \"2026-10-09T04:04:30.130Z\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-7826\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-15T15:47:45.659408Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-15T15:47:53.614Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-7826\", \"assignerOrgId\": \"33c584b5-0579-4c06-b2a0-8d8329fcab9c\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"securin\", \"dateReserved\": \"2026-05-05T02:50:40.051Z\", \"datePublished\": \"2026-10-09T04:04:30.130Z\", \"dateUpdated\": \"2026-10-15T15:47:58.390Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.