FalkorDB: Stack-based buffer overflow in RDB entity decoder
Summary
FalkorDB, a graph database running as a Redis module, contains a stack-based buffer overflow in the RDB decoder function _RdbLoadEntity. A crafted RDB stream with a large entity property count can overflow variable-length arrays on the thread stack. An attacker who can send Redis replication commands, for example to an instance without a password, can cause a denial of service and possibly execute arbitrary code.
Affected
- FalkorDB before 4.18.4
- VulDB lists 4.18.0 to 4.18.3 as affected; whether older branches are affected is unknown.
Fixed in
- FalkorDB 4.18.4 (fix commit 7d15431, PR #1973)
Workaround
- Require authentication on the instance (requirepass or ACLs).
- Restrict or rename the REPLICAOF and SLAVEOF commands so untrusted clients cannot use them.
- Do not expose the instance to untrusted networks.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof-of-concept found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- Code execution is theoretical; reliable exploitation is unlikely according to VulDB.
Our recommendation
- Upgrade FalkorDB to 4.18.4 or later, and check whether you run a newer 4.20.x build with separate issues.
- Inventory FalkorDB deployments, including Docker images and AI/RAG stacks that may bundle it.
- Confirm that the Redis port is not reachable from the internet and that authentication is required.
- Monitor for unexpected replication commands and restarts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit 7d15431 github.com
- Pull request #1973 github.com
- FalkorDB release v4.18.4 github.com
- OSV CVE-2026-7827 osv.dev
- VulDB CVE-2026-7827 vuldb.com
- VulDB entry 415715 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:47.
Original description (NVD)
A stack-based buffer overflow in the _RdbLoadEntity function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service and possibly execute arbitrary code by supplying a crafted RDB stream with an attacker-controlled entity property count. The count sizes two variable-length arrays on the thread stack with no upper bound, and the decoder then fills them with attacker-supplied values.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.