How Kimi K3 Uncovered Multiple Redis Zero‑Day RCE Bugs in Just 27 Minutes

1. Event Overview

On July 23, the research team "Bera Buddies" announced that Moonshot AI's newly released large language model Kimi K3 generated a complete vulnerability discovery workflow for Redis in 27 minutes after being given a single instruction to find memory‑corruption bugs such as buffer overflows and use‑after‑free.

The process involved cloning the Redis source, fuzzing, crash analysis with GDB, and finally producing non‑destructive RCE exploit code for Redis versions 6.2.22, 7.4.9, 8.6.4, and 8.8.0. The PoC is published at github.com/berabuddies/redis-poc.

2. Technical Details

2.1 Stream NACK Double‑Free (6.2.22/7.4.9/8.6.4)

The first vulnerability is a double‑free in the shared NACK path of Redis Stream consumer groups, related to an incomplete fix for CVE‑2026‑25589. A double‑free occurs when the same heap block is freed twice, allowing an attacker to corrupt heap metadata and achieve code execution.

Affected versions: 6.2.22, 7.4.9, 8.6.4. The issue was fully fixed only in Redis 8.8.0 via PR #15081.

2.2 TDigest Heap Overflow in RedisBloom (8.8.0)

The second vulnerability resides in the TDigest data structure of the RedisBloom module. The heap overflow can overwrite adjacent memory under specific conditions, leading to remote code execution. Exploitation relies on spraying the TDigest structure to obtain a deterministic jemalloc layout, so testing should be done on a fresh instance without concurrent commands.

3. Exploit Code

The GitHub repository provides version‑specific Python scripts:

A_exploit_stock.py : Redis 6.2.22 (DEBUG mode enabled)

P74_exploit.py (+P74_g2.py): Redis 7.4.9 (no DEBUG required)

P86_exploit.py : Redis 8.6.4 (no DEBUG required)

P88W_exploit.py (+P88W_lib.py, P88W_corrupt.py): Redis 8.8.0 (TDigest overflow)

Example execution for version 7.4.9:

# 7.4.9 example
docker run -d -p 6379:6379 redis:7.4 redis-server --requirepass exploitme
python3 P74_exploit.py 127.0.0.1 6379 exploitme "id > /data/pwned74"

All exploits are non‑destructive and write a proof file (e.g., /data/pwned*) rather than taking full control.

4. Attack Chain Analysis

Redis often sits behind application layers with password protection, but its command surface remains fully exposed. If an attacker obtains credentials through secret leaks, SSRF, or misconfigured ACLs, they can use the EVAL, RESTORE, and XGROUP commands to move from data‑store access to a host‑level shell without crashing the service.

5. Defense Recommendations

Immediate measures

Upgrade Redis to the patched versions.

Disable dangerous commands such as EVAL and RESTORE via rename‑command.

Restrict management commands for application users through ACLs.

Network isolation

Bind Redis to private interfaces only.

Never expose port 6379 to the Internet.

Authentication and key management

Use strong, non‑default passwords.

Rotate keys regularly and replace them immediately after any suspected leak.

Module audit

Disable or remove unused RedisBloom/TDigest modules.

Monitor official security advisories for Redis and RedisBloom.

Monitoring and alerts

Watch for anomalous use of XGROUP, RESTORE, or EVAL.

Detect unexpected keys appearing in the data directory.

6. Significance of AI‑Driven Vulnerability Discovery

Kimi K3’s 27‑minute, 32‑agent workflow demonstrates that AI can compress a weeks‑long manual audit of a large project like Redis into under half an hour. This lowers the barrier for vulnerability discovery, benefiting defenders who can use AI to find and patch flaws quickly, but also empowering attackers to accelerate exploit development.

The security community urges responsible disclosure: exploit code should not be widely distributed before vendors have sufficient time to release patches.