CVE-2025-46817
HIGH NUCLEIRedis < 6.2.20 - Authenticated Remote Code Execution via Lua Script Integer Overflow
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2025-46817. PoCs published by slayerkkkk. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional C exploit for CVE-2025-46817, targeting an integer overflow in Redis's Lua `unpack()` function. The exploit demonstrates a denial-of-service (crash) by triggering memory corruption via a crafted Lua script payload.
Description
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.
Exploits (1)
This repository contains a functional C exploit for CVE-2025-46817, targeting an integer overflow in Redis's Lua `unpack()` function. The exploit demonstrates a denial-of-service (crash) by triggering memory corruption via a crafted Lua script payload.
Nuclei Templates (1)
product:"redis"
References (3)
Scores
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H