CVE-2023-36824

CVE-2023-36824 is a critical heap overflow vulnerability affecting Redis versions prior to 7.0.12. Authenticated users can trigger this flaw by executing specially crafted COMMAND GETKEYS or COMMAND GETKEYSANDFLAGS commands, or other commands referencing variadic key lists, potentially leading to heap corruption, arbitrary memory reads, and remote code execution. With a CVSS score of 8.8 (High) and an EPSS percentile of 99.6%, the vulnerability presents a significant risk due to its network-based attack vector and high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation, public exploit code, or significant community discussion, the high FAUCET Risk Score of 99/100 indicates its severe potential.