CVE-2026-25588

high

Published 2026-05-05 · Modified 2026-05-07

CVSS v3

8.8

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2

—

VIR risk

8.8

Description

RedisTimeSeries is a time-series module for Redis. In all versions before 1.12.14 of RedisTimeSeries, the module does not properly validate serialized values processed through the Redis RESTORE command. An authenticated attacker with permission to execute RESTORE on a server with the RedisTimeSeries module loaded can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This has been patched in version 1.12.14.

Predictions

Exploit likelihood

92%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2026-25588.html

vendor Authored 2026-05-27

Vendor advisory: security-advisories@github.com — https://github.com/RedisTimeSeries/RedisTimeSeries/security/advisories/GHSA-7jwr-g5qv-w3gw

vendor Authored 2026-05-27

Vendor advisory: security-advisories@github.com — https://github.com/RedisTimeSeries/RedisTimeSeries/releases/tag/v1.12.14

OS impact

OS	Version	Status	Fixed in
sles		affected

Application impact

Vendor	Product	Versions	Fixed
redistimeseries	redistimeseries	`{"endExcluding":"1.12.14"}`	`1.12.14`

References

CWEs

CWE-122

Verify integrity in audit chain (admin only). AS-IS.