CVE-2026-25589

A flaw was found in RedisBloom. An authenticated attacker with permission to execute the RESTORE command on a Redis server with the RedisBloom module loaded can supply a crafted serialized payload that causes an invalid memory access due to an improper validation of serialized values processed through the Redis RESTORE command. This vulnerability can lead to remote code execution.

To exploit this issue, an authenticated attacker with permission to execute the RESTORE command needs to send a specially crafted serialized payload to be processed by Redis, limiting its exposure to authenticated users. This flaw allows the attacker to cause an invalid memory access, potentially resulting in remote code execution.

Default Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.

Due to these reasons, this vulnerability has been rated with an important severity.

Additionally, the RedisBloom module is embedded by default in Redis starting from version 8.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, restrict the execution privileges of the RESTORE command exclusively to highly trusted and administrative users by using the appropriate ACL rules.