A use-after-free memory corruption issue exists in the Lua scripting engine of Redis. An authenticated user can exploit this by sending a specially crafted Lua script to manipulate the Lua garbage collector (GC), allowing them to escape the Lua sandbox and execute arbitrary code on the host system. This can lead to full host takeover, enabling attackers to steal credentials, exfiltrate data, or install malware. Approximately 330,000 Redis instances are exposed to the internet, with at least 60,000 lacking authentication, making them highly susceptible to this attack. The issue affects all versions of Redis that support Lua scripting.