CVE-2026-7827: FalkorDB Buffer Overflow Vulnerability

CVE-2026-7827 Overview

CVE-2026-7827 is a stack-based buffer overflow in the _RdbLoadEntity function of the FalkorDB RDB graph decoders located under src/serializers/decoders/*/decode_graph_entities.c. The flaw affects FalkorDB versions prior to 4.18.4. A remote attacker who can issue Redis replication commands, for example against an instance with no password configured, can supply a crafted RDB stream containing an attacker-controlled entity property count. That count sizes two variable-length arrays (VLAs) on the thread stack with no upper bound, and the decoder then fills them with attacker-supplied values. The result is denial of service and possible arbitrary code execution.

Critical Impact
Unauthenticated remote attackers can corrupt the stack of a FalkorDB process via a crafted RDB replication stream, enabling denial of service and potential remote code execution.

Affected Products

FalkorDB versions prior to 4.18.4
FalkorDB current serializer path src/serializers/decoders/current/v19/decode_graph_entities.c
FalkorDB legacy serializer path src/serializers/decoders/prev/v10/decode_graph_entities.c

Discovery Timeline

2026-10-09 - CVE CVE-2026-7827 published to NVD
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-7827

Vulnerability Analysis

FalkorDB is a graph database module for Redis that persists graph state through Redis RDB serialization. The _RdbLoadEntity function reconstructs a graph entity by reading a property count n from the RDB stream and then declaring two VLAs sized by that attacker-controlled value: SIValue vals[n] and AttributeID ids[n]. Because n is a 64-bit unsigned integer loaded directly from the untrusted stream, large values push the stack pointer far past the mapped stack region, triggering a stack-based buffer overflow [CWE-121]. The decoder then iterates n times, writing attacker-controlled AttributeID and SIValue data into the arrays, which allows corruption of adjacent stack frames and saved return addresses.

Root Cause

The root cause is the use of VLAs sized by untrusted input without any upper bound. The original code pattern uint64_t n = RedisModule_LoadUnsigned(rdb); SIValue vals[n]; AttributeID ids[n]; assumes a well-formed RDB stream. A hostile replication peer can set n to an arbitrarily large value, bypassing stack guard pages or exhausting the stack region.

Attack Vector

Exploitation requires network access to a FalkorDB instance that accepts Redis replication commands, such as a deployment with no password configured. The attacker issues replication traffic containing a crafted RDB payload with a malicious entity property count. When the target decodes the stream, the VLA allocation and subsequent writes corrupt the thread stack.

// Patched code: src/serializers/decoders/prev/v10/decode_graph_entities.c
// Source: https://github.com/FalkorDB/FalkorDB/commit/7d15431aadf37588fadc2578b90c3afb5e8daa94

#define ENTITY_PROP_STACK_THRESHOLD 256

static void _RdbLoadEntity
(
    RedisModuleIO *rdb,
    GraphContext *gc,
    GraphEntity *e
) {
    // format:
    // #properties N
    // (name, value type, value) X N

    uint64_t n = RedisModule_LoadUnsigned(rdb);

    if (n == 0) {
        return;
    }
    // ... remainder of patch replaces the VLAs with a bounded
    //     stack buffer plus heap fallback when n exceeds the threshold
}

Source: GitHub Commit 7d15431

Detection Methods for CVE-2026-7827

Indicators of Compromise

Unexpected REPLICAOF or SLAVEOF commands directed at FalkorDB instances from untrusted hosts.
FalkorDB process crashes with SIGSEGV during RDB load, especially stack-related faults inside _RdbLoadEntity.
Core dumps or kernel logs showing stack overflow or guard-page violations in the FalkorDB module thread.

Detection Strategies

Monitor Redis CONFIG and REPLICAOF activity on hosts running FalkorDB and alert on new or unauthorized replication peers.
Inspect FalkorDB server logs for RDB parse errors, abnormal entity property counts, or repeated crashes shortly after inbound connections.
Deploy network telemetry to flag Redis protocol traffic from outside expected replication topologies.

Monitoring Recommendations

Track process lifecycle events for the FalkorDB and Redis binaries to catch repeated restarts following crashes.
Capture and retain stack traces or core dumps from any FalkorDB crash for forensic analysis.
Alert on authentication-free Redis instances exposed on the network perimeter.

How to Mitigate CVE-2026-7827

Immediate Actions Required

Upgrade FalkorDB to version 4.18.4 or later, which replaces the unbounded VLAs with a bounded stack buffer plus heap allocation.
Configure requirepass and ACLs on all Redis instances loading the FalkorDB module to prevent unauthenticated replication.
Restrict network exposure of Redis replication ports to known, trusted peers only.

Patch Information

The fix is tracked in GitHub Pull Request #1973 and committed as 7d15431. It introduces ENTITY_PROP_STACK_THRESHOLD 256, zero-count short-circuiting, and heap allocation for property arrays that exceed the stack threshold. The release containing the fix is published as FalkorDB v4.18.4.

Workarounds

Require strong authentication on every FalkorDB-enabled Redis instance using requirepass and Redis ACLs.
Firewall the Redis port (default 6379) so that only trusted replication peers can connect.
Disable or block the REPLICAOF and SLAVEOF commands via ACLs where replication is not required.

bash

# Configuration example: redis.conf hardening while patching is scheduled
requirepass <STRONG_RANDOM_PASSWORD>
bind 127.0.0.1 10.0.0.5
protected-mode yes

# Block replication administration commands for application users
user appuser on >app_password ~* +@all -replicaof -slaveof -config