Vulnerability · Published Oct 9, 2026 · Assigned by securin

CVE-2026-7827Stack-based buffer overflow in FalkorDB _RdbLoadEntity via unbounded property count in crafted RDB

High 8.1

In plain English

A high-severity stack buffer overflow in FalkorDB from FalkorDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.6%top 51.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A stack-based buffer overflow in the _RdbLoadEntity function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service and possibly execute arbitrary code by supplying a crafted RDB stream with an attacker-controlled entity property count. The count sizes two variable-length arrays on the thread stack with no upper bound, and the decoder then fills them with attacker-supplied values.

Affected products (as reported)

Vendor	Product	Versions
FalkorDB	FalkorDB	0 – before 4.18.4

Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

FalkorDB PR #1973 patch
Fix commit patch
FalkorDB 4.18.4 release notes release-notes