Read the docs
TI-2026-69848 Aliases CVE-2026-7826

Heap out-of-bounds read in FalkorDB via crafted RDB stream

Priority MEDIUM 44CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

FalkorDB before 4.18.4 has a heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function. The function's only bounds check is an ASSERT() that is compiled out of release builds, so a crafted RDB stream with a sub-buffer length larger than the remaining buffer makes memcpy() read past the heap allocation (CWE-125). A remote attacker who can issue Redis replication commands, for example against an instance with no password configured, can cause a denial of service or disclose heap memory.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializer_io.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or disclose heap memory by supplying a crafted RDB stream whose sub-buffer length field exceeds the remaining buffer size. The only bounds check is an ASSERT(), which is compiled out in release builds, so memcpy() reads past the end of the heap allocation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00433 37th percentileScored 2026-11-07
Fix Fixed FalkorDB (FalkorDB): 4.18.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FalkorDBFalkorDBbefore 4.18.44.18.4Patch availableCNA
  • FalkorDB VendorFalkorDB Affected before 4.18.4 Fixed in 4.18.4 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:falkordb:falkordb:*:*:*:*:*:*:*:*——FalkorDB
  • cpe:2.3:a:falkordb:falkordb:*:*:*:*:*:*:*:* Versions — — ·FalkorDB

Remediation

Upgrade FalkorDB to version 4.18.4 or later, which fixes the flaw. CISA lists no exploitation of this vulnerability in its catalog for federal agencies.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA FalkorDB (FalkorDB) Fixed in 4.18.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    FalkorDB 4.18.4

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-69849 Stack-based buffer overflow in FalkorDB RDB entity decodingPriority MEDIUM 42
    Show all 2 records →

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-7826
  2. 2026-10-10 Priority changed: MEDIUM → LOW
  3. 2026-10-16 CISA SSVC decision points changed
  4. 2026-10-16 Priority changed: LOW → MEDIUM

References

Patch 2

Other 1

  • TI-2026-05312 Unauthenticated Path Traversal in FalkorDB Browser Leads to Remote Code Execution CVSS 3.1CRITICAL 9.8
  • TI-2026-69850 Heap out-of-bounds write in FalkorDB Bolt RESET handler CVSS 4.0CRITICAL 9.3
  • TI-2026-69847 Double free and use-after-free in FalkorDB RDB loading CVSS 4.0CRITICAL 9.3
  • TI-2026-69851 Out-of-bounds write in FalkorDB Bolt WebSocket frame handling CVSS 4.0HIGH 8.8
  • TI-2026-08883 QueryWeaver Authentication Bypass via Email Signup Token Issuance for Existing Accounts CVSS 4.0HIGH 8.8
  • TI-2026-69852 Authentication bypass in FalkorDB Bolt endpoint CVSS 4.0CRITICAL 9.2
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences