CVE intelligence

CVE-2024-46981

Vulnerability intelligence

Published Jan 6, 2025Sources checked Oct 6, 2026

9.8CRITICALCVSS out of 10

What this means

Review the available evidence

CVE-2024-46981 and is rated Critical severity with a CVSS score of 9.8. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Aug 13, 2026

CBL-Mariner Releases

Vendor-listed releases

6.2.17-1
8.0.2-1

CISA KEVNot listedBased on the latest collected catalog

EPSS8.2%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2024-46981?

Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

Source: NVD