CVE-2025-48431
EUVD-2025-20958128.04.2026, 10:16
Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal "free(): invalid pointer" error message.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| apache | thrift | 𝑥 < 0.23.0 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Cryostat 4 on RHEL 9 | 4.2.0-16 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.14 | 1782693386 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.15 | 1780677003 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.16 | 1780926805 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift distributed tracing 3.10.2 | 1781589494 ≤ 𝑥 < * | ADP |
Debian Releases
Common Weakness Enumeration
- CWE-762 - Mismatched Memory Management RoutinesThe application attempts to return a memory resource to the system, but it calls a release function that is not compatible with the function that was originally used to allocate that resource.
- CWE-763 - Release of Invalid Pointer or ReferenceThe application attempts to return a memory resource to the system, but calls the wrong release function or calls the appropriate release function incorrectly.
References