CVE-2026-82677 valkey-io valkey Module Timer module.c moduleTimerHandler double free
Remote attackers can trigger a double free in the Valkey Module Timer subsystem, potentially causing denial of service or code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-82677?
CVE-2026-82677 is a medium-severity use after free vulnerability in valkey-io valkey, published on 31 Aug 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: b349fe2821e3998534b1454c1b64a478daf8c6b7. To fix this issue, it is recommended to deploy a patch.
Which versions are affected by CVE-2026-82677?
How do I fix CVE-2026-82677?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-82677 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82677 exists.
Sources
Also known as BELL-CVE-2026-82677, DEBIAN-CVE-2026-82677, ECHO-6215-20d8-e5f2, GHSA-pjvh-64mj-595g, UBUNTU-CVE-2026-82677.