Vulnerability Report

CVE-2025-62507

RCE

Title: Stack buffer overflow in Redis XACKDEL command

Memory Corruption

Proof Of Concept

PoC Available for CVE-2025-62507

CWE Category CWE-787

Published Date Nov 04, 2025

Modified Date Dec 08, 2025

Exploit Status Available

Score 7.7 CVSS v4.0

Exploit Probability (EPSS)

6.29%

Vulnerability Summary

CVE-2025-62507: Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command.

Impacted Vendors

redislabs 1

anynines 1

redis 1

Reference Links

https://github.com/redis/redis/commit/5f83972188f6e5b1d6f1940218c650a9cbdf7741 https://github.com/redis/redis/releases/tag/8.2.3 https://github.com/redis/redis/security/advisories/GHSA-jhjx-x4cf-4vm8

CVSS v4.0

Source Entity [email protected]

Severity HIGH

7.7

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

N/A

RAW VECTOR

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

Source Entity [email protected]

Severity HIGH

8.8

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2025-62507 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/Network-Sec/CVE-2025-62507-Buffer-Overflow_PoC

View Code

December 08, 2025 MODIFIED

Vulnerability data or affected products updated.

December 08, 2025 MODIFIED

Vulnerability data updated via NVD.

November 04, 2025 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity LOW

Privileges N/A

Interaction NONE

CVSS Vector String


                                    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected Stack

No specific products linked.