CVE-2026-82677

Summary

A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: b349fe2821e3998534b1454c1b64a478daf8c6b7. To fix this issue, it is recommended to deploy a patch.

Affected Software

Weaknesses

• CWE-415: Double Free
• CWE-119: Memory Corruption

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

Additional References

• https://vuldb.com/submit/893959
• https://github.com/valkey-io/valkey/issues/4200

References

• https://vuldb.com/vuln/397172
• https://vuldb.com/vuln/397172/cti
• https://vuldb.com/cve/CVE-2026-82677
• https://vuldb.com/submit/893959
• https://github.com/valkey-io/valkey/issues/4200
• https://github.com/valkey-io/valkey/pull/4211
• https://github.com/user-attachments/files/30118801/PoC.zip
• https://github.com/valkey-io/valkey/commit/b349fe2821e3998534b1454c1b64a478daf8c6b7
• https://github.com/valkey-io/valkey/

• ←Previous
• Next→