7.0
HIGH
CVE-2025-32023
Redis Heap Out-of-Bounds Write Remote Code Execution Vulnerability
Description

Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations implemented. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing hyperloglog operations. This can be done using ACL to restrict HLL commands.

INFO

Published Date :

July 7, 2025, 4:15 p.m.

Last Modified :

July 8, 2025, 4:18 p.m.

Remotely Exploitable :

No

Impact Score :

5.9

Exploitability Score :

1.0
Public PoC/Exploit Available at Github

CVE-2025-32023 has a 12 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2025-32023 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Redis redis

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

This is a reference to https://github.com/leesh3288/CVE-2025-32023, a bit modified.

Python

Updated: 2 weeks, 6 days ago
0 stars 0 fork 0 watcher
Born at : July 20, 2025, 6:23 a.m. This repo has been linked 1 different CVEs too.

None

Updated: 3 weeks, 3 days ago
2 stars 0 fork 0 watcher
Born at : July 16, 2025, 8:31 a.m. This repo has been linked 1 different CVEs too.

None

Updated: 3 weeks, 3 days ago
0 stars 0 fork 0 watcher
Born at : July 16, 2025, 8 a.m. This repo has been linked 1 different CVEs too.

Exploit for CVE-2025-32023

Updated: 4 weeks, 2 days ago
0 stars 1 fork 1 watcher
Born at : July 10, 2025, 9:08 a.m. This repo has been linked 1 different CVEs too.

Exploit for CVE-2025-32023

Updated: 4 weeks, 2 days ago
5 stars 2 fork 2 watcher
Born at : July 10, 2025, 6:46 a.m. This repo has been linked 1 different CVEs too.

CVE-2025-32023

Python

Updated: 3 weeks, 3 days ago
2 stars 1 fork 1 watcher
Born at : July 9, 2025, 9:34 p.m. This repo has been linked 1 different CVEs too.

PoC & Exploit for CVE-2025-32023 / PlaidCTF 2025 "Zerodeo"

Python

Updated: 2 weeks, 5 days ago
167 stars 33 fork 33 watcher
Born at : July 6, 2025, 6:09 p.m. This repo has been linked 1 different CVEs too.

This repo will give you the latest trending repo on github and giving you a grasp by sending email via Github Watching Features

daily github-actions trending-repositories

Python

Updated: 4 weeks, 1 day ago
7 stars 1 fork 1 watcher
Born at : March 21, 2025, 7:42 p.m. This repo has been linked 2 different CVEs too.

DSA and DLA for Debian last 14 days

Python

Updated: 17 hours, 17 minutes ago
0 stars 0 fork 0 watcher
Born at : Feb. 12, 2025, 2:08 p.m. This repo has been linked 63 different CVEs too.

Latest CVEs with their Proof of Concept exploits.

Python

Updated: 1 day, 5 hours ago
89 stars 10 fork 10 watcher
Born at : May 24, 2024, 11:02 a.m. This repo has been linked 81 different CVEs too.

TOP All bugbounty pentesting CVE-2023- POC Exp RCE example payload Things

bugbounty cve exp exploit payload poc rce vulnerability

Shell

Updated: 1 day, 4 hours ago
703 stars 121 fork 121 watcher
Born at : March 19, 2022, 1:54 a.m. This repo has been linked 283 different CVEs too.

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 17 hours, 13 minutes ago
7156 stars 1194 fork 1194 watcher
Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 813 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-32023 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2025-32023 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • New CVE Received by [email protected]

    Jul. 07, 2025

    Action Type Old Value New Value
    Added Description Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations implemented. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing hyperloglog operations. This can be done using ACL to restrict HLL commands.
    Added CVSS V3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
    Added CWE CWE-680
    Added Reference https://github.com/redis/redis/commit/50188747cbfe43528d2719399a2a3c9599169445
    Added Reference https://github.com/redis/redis/releases/tag/6.2.19
    Added Reference https://github.com/redis/redis/releases/tag/7.2.10
    Added Reference https://github.com/redis/redis/releases/tag/7.4.5
    Added Reference https://github.com/redis/redis/releases/tag/8.0.3
    Added Reference https://github.com/redis/redis/security/advisories/GHSA-rp2m-q4j6-gr43
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability