CVE-2025-32023

What it actually does

An authenticated user can trigger a stack or heap out-of-bounds write via specially crafted strings during hyperloglog operations, potentially leading to remote code execution.

Why it matters to the business

Attackers with valid credentials could gain full control of the database server, enabling data theft, tampering, or disruption. Rising exploit probability heightens the need for immediate action across affected deployments.

How an attack unfolds

An attacker with authenticated access submits a malicious string through hyperloglog commands to trigger memory corruption that can be leveraged for code execution on the server.

How to fix it

Upgrade to fixed versions 8.0.3, 7.4.5, 7.2.10, or 6.2.19. For the GIT repository, apply commit b49d5c0cf4e96a277d4b4e98f61d10c792b37003. As a workaround without patching the executable, use ACL rules to restrict all HLL commands.

How to confirm the fix worked

Confirm the installed version matches a fixed release or verify that ACL restrictions block hyperloglog commands. Test hyperloglog operations to ensure they are either updated or disabled.

Typical attack path

1. Obtain valid database credentials
2. Locate or enable access to hyperloglog operations
3. Submit a specially crafted string to trigger out-of-bounds write
4. Leverage memory corruption for remote code execution

How to detect it

Review authentication and command logs for hyperloglog usage patterns from unexpected sources or sequences that may indicate exploitation attempts.

What your security team should do

• Apply the listed version upgrades immediately due to available exploits and rising EPSS
• Implement ACL restrictions on HLL commands until patches are deployed
• Audit all database instances for exposure to hyperloglog operations