CVE-2025-62507 - CVE House

Back to Database

Status published High CVE-2025-62507

Redis: Bug in XACKDEL may lead to stack overflow and potential RCE

7.7 CVSS

Vulnerability Description

Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-62507

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from redis

View All →

Redis Lua Use-After-Free may lead to remote code execution

Redis DoS Vulnerability due to bad connection error handling

Redis is vulnerable to DoS via specially crafted LUA scripts

Redis: Authenticated users can execute LUA scripts as a different user

Lua library commands may lead to integer overflow and potential RCE

Affected Vendor

redis

View all reports →

Affected Software

redis

Vulnerable Versions:

>= 8.2.0, < 8.2.3

Timeline

Official Publish: November 4th, 2025

Last Modified: February 26th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation

T1055 Process Injection

Defense Evasion

T1105 Ingress Tool Transfer

Command and Control

T1485 Data Destruction