CVE-2025-46817

What it actually does

An authenticated user can submit a specially crafted Lua script that triggers an integer overflow in the Lua scripting engine, resulting in memory corruption that can be leveraged for remote code execution.

Why it matters to the business

Attackers with valid credentials can gain full control of the Redis server, exposing all stored data, enabling lateral movement, and providing a foothold for further attacks. Weaponized exploits and active threat actor interest increase urgency for organizations running affected versions.

How an attack unfolds

An attacker with valid Redis credentials crafts a malicious Lua script designed to cause integer overflow during script processing. The script is executed through the Redis Lua interface, triggering memory corruption that allows arbitrary code execution. This vulnerability is actively exploited in the RediShell campaign and shares similarities with CVE-2025-49844 targeting Valkey and Redis.

How to fix it

Upgrade all affected Redis instances to version 8.2.2 or apply the patch from commit 9829bdbfd9e7eeb8fb6c79ce36bcc77a681824b1. Restrict Lua scripting privileges to trusted users only until upgrades are complete.

How to confirm the fix worked

Confirm the running Redis version is 8.2.2 or newer. Verify the presence of commit 9829bdbfd9e7eeb8fb6c79ce36bcc77a681824b1 in the source tree and test that normal Lua scripting continues to function without errors.

Typical attack path

1. Obtain valid Redis authentication credentials
2. Craft a malicious Lua script targeting integer handling
3. Submit the script for execution via the Redis Lua scripting interface
4. Trigger the integer overflow leading to memory corruption
5. Leverage corruption to achieve remote code execution

How to detect it

Review Redis logs for unusual or complex Lua scripts, monitor for unexpected child processes spawned by the Redis server, and correlate authentication events with script execution from known threat actor infrastructure associated with RediShell.

What your security team should do

• Prioritize immediate upgrade of all Redis deployments to 8.2.2
• Audit and minimize accounts permitted to execute Lua scripts
• Enable detailed logging of Lua script submissions for monitoring
• Review network exposure of Redis instances and enforce least-privilege access