CVE-2026-7826 Details
Description
A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializer_io.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or disclose heap memory by supplying a crafted RDB stream whose sub-buffer length field exceeds the remaining buffer size. The only bounds check is an ASSERT(), which is compiled out in release builds, so memcpy() reads past the end of the heap allocation.
A heap-based out-of-bounds read vulnerability has been identified in FalkorDB versions prior to 4.18.4. The issue arises in the BufferSerializerIOv2_ReadBuffer function, where inadequate bounds checking allows a remote attacker to exploit Redis replication commands. This exploitation can lead to a denial-of-service condition or unauthorized disclosure of heap memory. The vulnerability is triggered by sending a crafted RDB stream with a sub-buffer length that exceeds the remaining buffer size. The only existing bounds check is an ASSERT() macro, which is removed in release builds, enabling memcpy() to read beyond the allocated heap memory.
Users can upgrade to FalkorDB version 4.18.4 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FalkorDB/FalkorDB/commit/55d986f45ecd5d80f7a9e5e138e8b0f96535b48c | securin | Source CodeVendor |
| https://github.com/FalkorDB/FalkorDB/pull/1972 | securin | Issue TrackingVendor |
| https://github.com/FalkorDB/FalkorDB/releases/tag/v4.18.4 | securin | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | securin |
Affected Products
| Product | Versions |
|---|---|
| FalkorDB | < 4.18.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | securin |