Valkey Vulnerability Allows Remote Code Execution via Numeric Truncation
A numeric truncation error in Valkey's clusterCreatePublishMsgBlock function, disclosed by Zero Day Initiative, allows authenticated remote attackers to execute arbitrary code with a CVSS score of 8.8.
The open-source in-memory data structure store, Valkey, is affected by a critical vulnerability that could allow remote attackers to execute arbitrary code on vulnerable systems. The flaw, identified as ZDI-26-833, resides within the clusterCreatePublishMsgBlock function and stems from a numeric truncation error. This means that improper handling of user-supplied data leads to incorrect calculations before memory is allocated, creating an exploitable condition.
To successfully exploit this vulnerability, an attacker must first possess valid authentication credentials for the target Valkey instance. Once authenticated, they can craft and send malicious messages that trigger the flawed logic. The vulnerability allows for code execution within the context of the service account running Valkey, which could grant attackers significant control over the affected server.
The Zero Day Initiative (ZDI) reported the vulnerability, highlighting its severity with a CVSS score of 8.8. This score indicates a high level of risk, emphasizing the importance of timely patching and mitigation efforts. The vulnerability was publicly disclosed on October 28, 2026, following coordinated disclosure practices.
Valkey has addressed this vulnerability by releasing an update. Users are strongly advised to apply the patch as soon as possible to protect their deployments. The specific advisory detailing the fix can be found on Valkey's GitHub security page, linked from the ZDI advisory.
The vulnerability was initially reported to the vendor on October 1, 2026, allowing ample time for a fix to be developed and tested before public disclosure. The coordinated release ensures that users are informed and have access to a solution when the vulnerability becomes widely known.
This discovery underscores the ongoing security challenges faced by popular open-source projects. Even widely adopted software like Valkey, which is a fork of Redis, can harbor critical flaws that require diligent security research and prompt vendor response. The requirement for authentication means that exposed and unsecured instances are less likely targets, but internal or compromised systems remain at risk.
Nenad Stojanovski is credited with discovering and reporting this vulnerability. Security researchers like Stojanovski play a crucial role in identifying and responsibly disclosing such flaws, contributing to the overall security posture of the software ecosystem. The disclosure timeline indicates a smooth and collaborative process between the researcher and the Valkey maintainers.