High severity · published Oct 3, 2025
CVE-2025-46819
Redis is an open source, in-memory database that persists on disk
7.1
CVSS
1.1%
EPSS
No
On KEV
Description
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
Redis · Redis
before 6.2.20; 7.0 before 7.2.11; 7.4.0 before 7.4.6; 8.0.0 before 8.0.4; 8.2.0 before 8.2.2 · source: NVD
In the news
VulnerabilityCritical
Schneider Electric Plant iT/Brewmaxx
View CSAF
Summary
Successful exploitation of these vulnerabilities could risk privilege escalation, which could result in remote code execution.
The following versions of Schneider Electric Plant iT/Brewmaxx are affected:
Plant iT/Brewmaxx 9.60_and_above (CVE-2025-49844, CVE-2025-46817, CVE-2025-46818, CVE-2025-46819)
CVSS
Vendor
Equipment
Vulnerabilities
v3 9.9
Schneider Electric
Schneider Electric Plant iT/Brewmaxx
Use After Free, Integer Overflow or Wraparound, Improper Control of Generation of Code ('Code Injection')
Background
Critical Infrastructure Sectors: Energy, Critical Manufacturing, Commercial Facilities
Countries/Areas Deployed: Worldwide
Company Headquarters Location: France
Vulnerabilities
Expand All +
CVE-2025-49844
The affected product uses Redis, an open-source, in-memory database. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free, and potentially lead to remote code execution.
View CVE Details
Affected Products
Schneider Electric Plant iT/Brewmaxx
Vendor: Schneider Electric
Product Version: Schneider Electric Plant iT/Brewmaxx: 9.60_and_above
Product Status: known_affected
Remediations
Mitigation Schneider Electric recommends users immediately apply the following mitigations to reduce the risk of exploit:
Mitigation Install P...
Mar 24, 2026·CISA Advisories
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-46819
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-46819
Patch
https://github.com/redis/redis/commit/3a1624da2449ac3dbfc4bdaed43adf77a0b7bfba
Release Notes
https://github.com/redis/redis/releases/tag/8.2.2
Third Party Advisory
https://github.com/redis/redis/security/advisories/GHSA-4c68-q8q8-3g4f
Third Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-46819-detect-redis-vulnerability
Mitigation
https://www.vicarius.io/vsociety/posts/cve-2025-46819-mitigate-redis-vulnerability
More from Redis
10.0
CVE-2022-0543
Debian-specific Redis Server Lua Sandbox Escape Vulnerability
9.9
CVE-2025-49844
Redis is an open source, in-memory database that persists on disk
9.8
CVE-2025-27151
Redis is an open source, in-memory database that persists on disk
9.8
CVE-2024-46981
Redis' Lua library commands may lead to remote code execution
9.8
CVE-2022-3734
Redis on Windows dbghelp.dll uncontrolled search path