Redis Streams Shared-NACK Double-Free (CVE-2026-25243) & RedisBloom RESTORE/TDigest Heap Overflow (CVE-2026-25589) — Authenticated RCE, Public PoC, Patch Bypass — Threadlinqs Intelligence
As of 2026-07-25, Redis Streams Shared-NACK Double-Free (CVE-2026-25243) & RedisBloom RESTORE/TDigest Heap Overflow (CVE-2026-25589) — Authenticated RCE, Public PoC, Patch Bypass is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-1690 · Severity: HIGH · CVSS: 8.8 · Status: ACTIVE · Category: VULNERABILITY
Security researchers 'Bera Buddies', using an AI agent (Kimi K3), publicly disclosed on 2026-07-23 that Redis's May 2026 fix for a Streams consumer-group shared-NACK double-free (CVE-2026-25243) was
On 2026-05-05 Redis published a coordinated security advisory covering five vulnerabilities discovered largely through the Wiz ZeroDay.Cloud research event: CVE-2026-23479 (unblock-client use-after-free), CVE-2026-25243 (RESTORE command double-free/invalid memory access in core Redis, reported by Emil Lerner and Joseph Surin), CVE-2026-25588 (RESTORE + RedisTimeSeries invalid memory access), CVE-2026-25589 (RESTORE + RedisBloom invalid memory access, reported by Daniel Firer and Joseph Surin), and CVE-2026-23631 (Lua scripting use-after-free on replicas). Redis shipped fixed releases the same day (OSS/CE 6.2.22, 7.2.14, 7.4.9, 8.2.6, 8.4.3, 8.6.3; RedisBloom 2.8.20; RedisTimeSeries 1.12.14) and stated no evidence of exploitation.
On 2026-07-23, the AI-agent security research group 'Bera Buddies' (researcher Chaofan Shou publicizing on X) disclosed that the May fix for the Streams shared-NACK ownership bug (CVE-2026-25243) never actually shipped in the 6.2.22, 7.4.9 and 8.6.4 releases users had been told to install — a patch-verification gap, not a new root cause — making a reliable authenticated RCE chain reproducible on 'patched' installs (10/10 on 6.2.22, 5/5 on 7.4.9, 25/25 on 8.6.4 in the public PoC). Separately, they found a genuinely new, previously unpatched heap overflow in the bundled RedisBloom TDigest RDB loader on fresh Redis 8.8.0 instances: the loader allocates a centroid array sized from the serialized compression value but then trusts a separate, attacker-controlled capacity field when deciding how many nodes to load, producing a small real allocation paired with inflated metadata and an out-of-bounds write. This TDigest bug is part of the broader RESTORE+RedisBloom vulnerability class tracked as CVE-2026-25589.
Both chains require RESTORE to deliver the malformed serialized payload; the Streams chain additionally needs EVAL and XGROUP. The published exploit chain proceeds: (1) a malformed RESTORE payload (corrupt zipmap or a stream with duplicate NACK entries) triggers the double-free; (2) the attacker sprays uniquely-marked Redis strings to find overlapping heap allocations; (3) SETRANGE overwrites object headers on the overlap to forge a ~1MB fake SDS string as a read/write memory viewport; (4) predictable INCRBYFLOAT float allocations are located and their pointers redirected through the viewport, giving arbitrary read/write via GETRANGE/SETRANGE; (5) the heap is scanned from known addresses for the global redisServer struct, identified by recognizable fields (pid, thread_id, executable path, config values); (6) server.executable and server.exec_argv are overwritten in memory to point at /bin/sh and shell arguments, the DEBUG command is enabled, and DEBUG CRASH-AND-RECOVER is issued to force execve() and hand the attacker a shell. The PoC notes the technique is layout-sensitive on 8.8.0 (jemalloc memory layout, retries needed on grooming misses) and that it leaves inert exploit keys and corrupted structures behind — operators are advised to avoid FLUSHALL/SAVE, which could mask forensic residue.
Redis responded the same day (2026-07-23) with seven emergency releases: 6.2.23, 7.2.15 and 7.4.10 fix the Streams shared-NACK use-after-free that the May releases had missed; 8.2.8, 8.4.5 and 8.6.5 fix both the Streams issue and the RedisBloom/TDigest out-of-bounds write; 8.8.1 fixes the RedisBloom/TDigest loader specifically (the Streams guard was already present in 8.8.0). As of 2026-07-25, CVE-2026-25243 carries CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and CVE-2026-25589 carries CVSS v4.0 7.7; neither CVE appears in the CISA Known Exploited Vulnerabilities catalog and Redis states it has no evidence of exploitation in its own environment or customer environments. Exploitation in all cases is strictly post-authentication and depends on the attacker's Redis identity being permitted to run RESTORE (and, for the Streams chain, EVAL/XGROUP) — a permission surface Redis's own advisory calls out as common
Weaknesses (CWE)
CWE-122, CWE-415, CWE-20
Target sectors: technology, cloud-computing, financial-services, ecommerce, saas, gaming
Target regions: Global
Detections & IOCs
As of 2026-08-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-25589, CVE-2026-25243, T1595, T1592.004, T1588.006, T1587.001, T1078, T1190, T1059, T1059.004, T1210, T1068
