An authenticated user may use a specially crafted RESTORE command to inject a malformed RDB payload containing duplicate Pending Entry List (PEL) assignments. This triggers a use-after-free during stream consumer group deserialization or consumer deletion, potentially leading to remote code execution.

The problem exists in all versions of Valkey.