Description

A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: b349fe2821e3998534b1454c1b64a478daf8c6b7. To fix this issue, it is recommended to deploy a patch.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.4",
  "pubDate": "2026-08-31T10:16:50.780Z",
  "pubdate": "2026-08-31T10:16:50.780Z",
  "executiveSummary": "A critical memory corruption vulnerability exists in the Module Timer Subsystem of Valkey version 9.1.0. The flaw manifests as a double free vulnerability within the moduleTimerHandler function located in src/module.c.\nThis vulnerability allows an unauthenticated remote attacker to trigger a double free condition, which may result in arbitrary code execution, system instability, or denial-of-service.\nThe vulnerability is actively exposed through public disclosure of exploit material, increasing the urgency of remediation.\nSuccessful exploitation requires the ability to interact with the Valkey module subsystem remotely, leading to potential compromise of the data store process memory space.",
  "technicalDetails": "The vulnerability resides in the src/module.c component of the Valkey 9.1.0 Module Timer Subsystem. Specifically, the function moduleTimerHandler fails to properly manage the lifecycle of timer-related memory objects, leading to a race condition or logic error that results in a double free operation.\nA double free occurs when the application attempts to deallocate the same memory address multiple times without an intervening allocation. In this instance, the memory management routines in moduleTimerHandler permit the freeing of a pointer that has already been returned to the heap allocator. This behavior corrupts the heap metadata, allowing an attacker to manipulate the free list structures maintained by the memory allocator.\nThe attack flow begins with an attacker invoking functionality that registers or triggers module timers remotely. By carefully crafting requests to the Valkey module subsystem, an attacker can induce the moduleTimerHandler to execute the free operation twice on the same memory block. This corruption typically occurs during the processing of timer events within the event loop.\nOnce the heap metadata is corrupted, subsequent allocations may overlap with freed memory regions, allowing an attacker to overwrite sensitive function pointers, object metadata, or other critical data structures. If an attacker can control the contents of the memory being allocated, they can redirect the application's execution flow to arbitrary code, effectively achieving remote code execution (RCE) with the privileges of the Valkey process.\nThe remote exploitability of this flaw is significant as it does not inherently require prior authentication, depending on the specific module configurations exposed to network traffic. Because the vulnerability is publicly disclosed, the risk of automated exploitation by malicious actors is high. The post-exploitation impact includes full system compromise, data exfiltration, or a total crash of the Valkey service due to SIGABRT or heap inconsistency errors."
}