CVE-2026-86227

Received Received - Intake

Out-of-Bounds Read in Valkey up to 9.0.5/9.1.1

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: VulDB

Description

A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.c. This manipulation of the argument didx causes out-of-bounds read. It is possible to initiate the attack remotely. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 4691888e7fab3df128f0bde5750c9fde2ae552fa. To fix this issue, it is recommended to deploy a patch. Exploitation requires cluster mode plus attacker-controlled dump.rdb at startup (data-dir write access, replication feed, or a stored crafted RDB) - an attacker-position DoS at boot, not network pre-auth. The issue report was closed stating it "is worth fixing for the sake of memory safety… but I don't think it meets our bar for a security disclosure."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-06

Last Modified

2026-09-06

Generated

2026-09-07

AI Q&A

2026-09-07

EPSS Evaluated

N/A

NVD

CVE-2026-86227

EUVD

EUVD-2026-72176

Affected Vendors & Products

Vendor	Product	Version / Range
valkey-io	valkey	From 9.1.1 (inc) to 9.0.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds read issue in the valkey-io valkey software versions up to 9.0.5/9.1.1. It occurs in the function kvstoreGetHashtable within the file src/kvstore.c. The problem arises from manipulation of the didx argument, leading to reading memory outside the intended bounds. The attack requires specific conditions like cluster mode and attacker-controlled dump.rdb at startup, making it a complex and difficult exploit.

Detection Guidance

Detection requires checking for Valkey versions up to 9.0.5/9.1.1 and verifying if cluster mode is enabled. Exploitation involves attacker-controlled dump.rdb at startup. Monitor for unusual memory corruption or crashes during boot in cluster mode.

Impact Analysis

The impact is limited but includes potential denial-of-service (DoS) at boot time. An attacker with write access to the data directory or replication feed could craft a malicious RDB file to trigger the vulnerability. This results in a system crash or instability rather than data theft or unauthorized access.

Compliance Impact

This vulnerability is an out-of-bounds read issue in valkey-io valkey that requires specific conditions to exploit, such as cluster mode and attacker-controlled dump.rdb at startup. It does not directly impact data confidentiality or integrity but could lead to denial-of-service (DoS) conditions during system boot. Compliance impact depends on whether the affected system processes sensitive data under GDPR or HIPAA, as DoS could disrupt availability of critical services.

Mitigation Strategies

Immediately update Valkey to a patched version beyond 9.0.5/9.1.1 using the provided patch 4691888e7fab3df128f0bde5750c9fde2ae552fa. Disable cluster mode if not required or restrict write access to data directories.

Hi! I’m here to help you understand CVE-2026-86227. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70