{"api_version":"1","generated_at":"2026-10-09T07:47:37+00:00","cve":"CVE-2026-7826","urls":{"html":"https://cve.report/CVE-2026-7826","api":"https://cve.report/api/cve/CVE-2026-7826.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-7826","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-7826"},"summary":{"title":"Heap out-of-bounds read in FalkorDB BufferSerializerIOv2_ReadBuffer via crafted RDB","description":"A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializer_io.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or disclose heap memory by supplying a crafted RDB stream whose sub-buffer length field exceeds the remaining buffer size. The only bounds check is an ASSERT(), which is compiled out in release builds, so memcpy() reads past the end of the heap allocation.","state":"PUBLISHED","assigner":"securin","published_at":"2026-10-09 05:16:45","updated_at":"2026-10-09 05:16:45"},"problem_types":["CWE-125","CWE-125 CWE-125 Out-of-bounds Read"],"metrics":[{"version":"4.0","source":"33c584b5-0579-4c06-b2a0-8d8329fcab9c","type":"Secondary","score":"8.8","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"CVSS","score":"8.8","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","data":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"}},{"version":"3.1","source":"33c584b5-0579-4c06-b2a0-8d8329fcab9c","type":"Secondary","score":"9.1","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"9.1","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","data":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://github.com/FalkorDB/FalkorDB/commit/55d986f45ecd5d80f7a9e5e138e8b0f96535b48c","name":"https://github.com/FalkorDB/FalkorDB/commit/55d986f45ecd5d80f7a9e5e138e8b0f96535b48c","refsource":"33c584b5-0579-4c06-b2a0-8d8329fcab9c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/FalkorDB/FalkorDB/pull/1972","name":"https://github.com/FalkorDB/FalkorDB/pull/1972","refsource":"33c584b5-0579-4c06-b2a0-8d8329fcab9c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/FalkorDB/FalkorDB/releases/tag/v4.18.4","name":"https://github.com/FalkorDB/FalkorDB/releases/tag/v4.18.4","refsource":"33c584b5-0579-4c06-b2a0-8d8329fcab9c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7826","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7826","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"FalkorDB","product":"FalkorDB","version":"affected 4.18.4 semver","platforms":[]}],"timeline":[{"source":"CNA","time":"2026-04-24T00:00:00.000Z","lang":"en","value":"Reported to FalkorDB"},{"source":"CNA","time":"2026-05-05T00:00:00.000Z","lang":"en","value":"CVE ID shared with the vendor"},{"source":"CNA","time":"2026-05-07T00:00:00.000Z","lang":"en","value":"Fix merged by the vendor (PR #1972)"},{"source":"CNA","time":"2026-05-07T00:00:00.000Z","lang":"en","value":"FalkorDB 4.18.4 released with the fix"}],"solutions":[{"source":"CNA","title":"","value":"Upgrade FalkorDB to version 4.18.4 or later.","time":"","lang":"en"}],"workarounds":[{"source":"CNA","title":"","value":"Require authentication on the Redis/FalkorDB instance (requirepass or ACLs), restrict or rename the REPLICAOF/SLAVEOF commands so untrusted clients cannot use them, and do not expose the instance to untrusted networks.","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"Arjun Basnet from Securin","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"collectionURL":"https://github.com/FalkorDB/FalkorDB","cpes":["cpe:2.3:a:falkordb:falkordb:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["RDB serializer / graph decoder"],"product":"FalkorDB","programFiles":["src/serializers/serializer_io.c"],"programRoutines":[{"name":"BufferSerializerIOv2_ReadBuffer"}],"repo":"https://github.com/FalkorDB/FalkorDB","vendor":"FalkorDB","versions":[{"lessThan":"4.18.4","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Arjun Basnet from Securin"}],"descriptions":[{"lang":"en","value":"A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializer_io.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or disclose heap memory by supplying a crafted RDB stream whose sub-buffer length field exceeds the remaining buffer size. The only bounds check is an ASSERT(), which is compiled out in release builds, so memcpy() reads past the end of the heap allocation."}],"impacts":[{"capecId":"CAPEC-540","descriptions":[{"lang":"en","value":"CAPEC-540 Overread Buffers"}]}],"metrics":[{"cvssV4_0":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV3_1":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-125","description":"CWE-125 Out-of-bounds Read","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-09T04:04:30.130Z","orgId":"33c584b5-0579-4c06-b2a0-8d8329fcab9c","shortName":"securin"},"references":[{"name":"FalkorDB PR #1972","tags":["patch"],"url":"https://github.com/FalkorDB/FalkorDB/pull/1972"},{"name":"Fix commit","tags":["patch"],"url":"https://github.com/FalkorDB/FalkorDB/commit/55d986f45ecd5d80f7a9e5e138e8b0f96535b48c"},{"name":"FalkorDB 4.18.4 release notes","tags":["release-notes"],"url":"https://github.com/FalkorDB/FalkorDB/releases/tag/v4.18.4"}],"solutions":[{"lang":"en","value":"Upgrade FalkorDB to version 4.18.4 or later."}],"source":{"discovery":"EXTERNAL"},"timeline":[{"lang":"en","time":"2026-04-24T00:00:00.000Z","value":"Reported to FalkorDB"},{"lang":"en","time":"2026-05-05T00:00:00.000Z","value":"CVE ID shared with the vendor"},{"lang":"en","time":"2026-05-07T00:00:00.000Z","value":"Fix merged by the vendor (PR #1972)"},{"lang":"en","time":"2026-05-07T00:00:00.000Z","value":"FalkorDB 4.18.4 released with the fix"}],"title":"Heap out-of-bounds read in FalkorDB BufferSerializerIOv2_ReadBuffer via crafted RDB","workarounds":[{"lang":"en","value":"Require authentication on the Redis/FalkorDB instance (requirepass or ACLs), restrict or rename the REPLICAOF/SLAVEOF commands so untrusted clients cannot use them, and do not expose the instance to untrusted networks."}]}},"cveMetadata":{"assignerOrgId":"33c584b5-0579-4c06-b2a0-8d8329fcab9c","assignerShortName":"securin","cveId":"CVE-2026-7826","datePublished":"2026-10-09T04:04:30.130Z","dateReserved":"2026-05-05T02:50:40.051Z","dateUpdated":"2026-10-09T04:04:30.130Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-09 05:16:45","lastModifiedDate":"2026-10-09 05:16:45","problem_types":["CWE-125","CWE-125 CWE-125 Out-of-bounds Read"],"metrics":{"cvssMetricV40":[{"source":"33c584b5-0579-4c06-b2a0-8d8329fcab9c","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"33c584b5-0579-4c06-b2a0-8d8329fcab9c","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"7826","Ordinal":"1","Title":"Heap out-of-bounds read in FalkorDB BufferSerializerIOv2_ReadBuf","CVE":"CVE-2026-7826","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"7826","Ordinal":"1","NoteData":"A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializer_io.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or disclose heap memory by supplying a crafted RDB stream whose sub-buffer length field exceeds the remaining buffer size. The only bounds check is an ASSERT(), which is compiled out in release builds, so memcpy() reads past the end of the heap allocation.","Type":"Description","Title":"Heap out-of-bounds read in FalkorDB BufferSerializerIOv2_ReadBuf"}]}}}