Redis CVE-2025-49844: Brief Summary of Critical Lua Use-After-Free RCE Vulnerability

Introduction

Remote code execution through authenticated Lua scripts in Redis can lead to full compromise of in-memory data, session tokens, and application state. CVE-2025-49844 is a critical use-after-free vulnerability in every Redis deployment up to version 8.2.1 that has Lua scripting enabled. An attacker with script execution privileges can exploit it to run arbitrary code on the server.

Redis is a widely used open-source in-memory data store that handles caching, session management, and analytics for thousands of organizations around the world. Its Lua scripting engine lets users run atomic server-side logic. It also brings hard memory-management problems, which have caused several high-impact vulnerabilities.

Technical information

CVE-2025-49844 is a use-after-free vulnerability in the Lua scripting subsystem of Redis. The flaw is in how the Lua virtual machine's garbage collector interacts with Redis's script execution logic. An authenticated user with access to the EVAL or EVALSHA commands can submit a crafted Lua script that manipulates object references and the timing of garbage collection cycles. That script can make the garbage collector free memory that active objects still reference.

When the Lua VM or Redis later reuses that freed memory, the result can be memory corruption. In practice, an attacker can use this to execute code remotely inside the Redis server process. The root cause is that the garbage collector does not check closely enough whether objects are still live, which lets scripts trigger premature deallocation and unsafe reuse of memory.

All Redis versions that support Lua scripting, up to and including 8.2.1, are affected. The vulnerability is present in any deployment configuration, as long as Lua scripting is enabled and authenticated users can reach it.

Patch information

Redis has released a patch for CVE-2025-49844 that hardens the Lua scripting engine against remote code execution through manipulated scripts. The vulnerability has a CVSS score of 10.0. It involves a use-after-free condition in the Lua garbage collector that an authenticated user could manipulate to execute arbitrary code remotely.

The patch makes four changes to tighten memory management and block unauthorized memory access:

1. The Lua garbage collector has additional checks that detect and prevent premature deallocation of memory objects still in use. Memory is freed only when no part of the program can reach it anymore.

2. New validation steps verify memory references during Lua script execution. These checks help identify and block attempts to access memory that has been freed or lies outside the allocated bounds.

3. Stricter controls on Lua script execution limit how much scripts can manipulate internal memory structures, which reduces the risk of operations that could lead to memory corruption.

4. The Redis code now uses safer Lua API functions that perform boundary checks and manage memory more securely. This minimizes the risk of introducing vulnerabilities through API misuse.

Implementation details:

The code changes are:

• lgc.c in the Lua source adds validation checks during the garbage collection cycle.

• lvm.c adds boundary checks during virtual machine operations.

• ldo.c enforces stricter execution policies for Lua scripts.

• Deprecated or unsafe API calls are replaced with safer counterparts across the files that interact with the Lua engine.

Together, these changes fix the root cause of the vulnerability and guard against similar issues in the future.

Upgrade recommendations:

Users are strongly advised to upgrade their Redis installations to the latest patched versions. These releases fix the vulnerability:

• Redis Software: Versions 7.22.2-12 and above, 7.8.6-207 and above, 7.4.6-272 and above, 7.2.4-138 and above, 6.4.2-131 and above.

• Redis OSS/CE/Stack: Versions 8.2.2 and above, 8.0.4 and above, 7.4.6 and above, 7.2.11 and above.

The official Redis documentation has detailed upgrade instructions and best practices for securing a Redis deployment.

This summary is based on the Redis Security Advisory: CVE-2025-49844.