CVE-2026-7826

Name of the Vulnerable Software and Affected Versions FalkorDB versions prior to 4.18.4

Description A heap-based out-of-bounds read occurs in the BufferSerializerIOv2 ReadBuffer() function within src/serializers/serializer io.c. A remote attacker capable of issuing Redis replication commands can trigger this by providing a crafted RDB stream where the sub-buffer length field is larger than the remaining buffer size. Because the bounds check relies on an ASSERT() that is removed during release builds, the memcpy() function reads beyond the allocated heap memory, potentially leading to a denial of service or the disclosure of heap memory.

Recommendations Update to version 4.18.4 or later.