it doesn't get worse than this (CVSS 10.0)

A critical CVSS 10.0 vulnerability in Redis involves a use-after-free bug in its custom Lua interpreter implementation. The flaw occurs when the garbage collector fails to properly track T-string objects, allowing freed memory to be reused while still accessible, potentially leading to type confusion and remote code execution. The vulnerability requires authentication to exploit and demonstrates how even garbage-collected languages can have memory safety issues in their runtime implementations.