Critical severity · published Oct 28, 2022
CVE-2022-3734
Redis on Windows dbghelp.dll uncontrolled search path
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
A vulnerability was found in a port or fork of Redis. It has been declared as critical. This vulnerability affects unknown code in the library C:/Program Files/Redis/dbghelp.dll. The manipulation leads to uncontrolled search path. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier of this vulnerability is VDB-212416. NOTE: The official Redis release is not affected. This issue might affect an unofficial fork or port on Windows only.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
Redis · Redis
All versions, or not specified · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-3734
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-3734
Permissions Required
https://vuldb.com/?id.212416
Permissions Required
https://www.cnblogs.com/J0o1ey/p/16829380.html
More from Redis
10.0
CVE-2022-0543
Debian-specific Redis Server Lua Sandbox Escape Vulnerability
9.9
CVE-2025-49844
Redis is an open source, in-memory database that persists on disk
9.8
CVE-2025-27151
Redis is an open source, in-memory database that persists on disk
9.8
CVE-2024-46981
Redis' Lua library commands may lead to remote code execution
9.8
CVE-2022-35951
Redis is an in-memory database that persists on disk