FalkorDB: Heap out-of-bounds read in RDB deserialization
Summary
FalkorDB before 4.18.4 contains a heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function when parsing RDB data received through Redis replication commands. The only bounds check was an ASSERT(), which is removed in release builds, so a crafted sub-buffer length can make memcpy() read past the end of a heap allocation. A remote attacker who can send replication commands, for example to an instance without a password, may cause a denial of service or disclose heap memory.
Affected
- FalkorDB versions before 4.18.4
- Unknown whether 6.x releases are affected.
Fixed in
- Upgrade to FalkorDB 4.18.4 or later (fix referenced in commit 55d986f and PR #1972).
- Newer 4.x and 6.0 releases exist; verify the vendor release notes before upgrading, as 4.x and 6.0 should not be mixed in the same primary/replica set.
Workaround
- Require authentication on the instance (requirepass or ACLs).
- Restrict or rename the REPLICAOF and SLAVEOF commands so untrusted clients cannot use them.
- Do not expose the instance to untrusted networks.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- No confirmed in-the-wild exploitation or public proof of concept known at the time of research.
Our recommendation
- Upgrade FalkorDB to 4.18.4 or later, or a later vendor-recommended release.
- Until patched, enforce authentication and restrict access to the Redis protocol port and replication commands.
- Check whether any FalkorDB instance is reachable from untrusted networks and monitor for unexpected replication traffic.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-7826 fix commit github.com
- FalkorDB pull request #1972 github.com
- FalkorDB release v4.18.4 github.com
- Securin CVE-2026-7826 www.securin.io
- OSV CVE-2026-7826 osv.dev
- VulDB CVE-2026-7826 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:05.
Original description (NVD)
A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializer_io.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or disclose heap memory by supplying a crafted RDB stream whose sub-buffer length field exceeds the remaining buffer size. The only bounds check is an ASSERT(), which is compiled out in release builds, so memcpy() reads past the end of the heap allocation.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.