PatchSiren cyber security CVE debrief

CVE-2025-48431 Apache CVE debrief

CVE-2025-48431 is a Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. The issue affects Apache Thrift versions before 0.23.0. Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal 'free(): invalid pointer' error message. Users are recommended to upgrade to version 0.23.0, which fixes the issue. The CVSS score for this vulnerability is 7.5, indicating a HIGH severity.

Vendor: Apache
Product: Thrift
CVSS: HIGH 7.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-04-28
Original CVE updated: 2026-09-10
Advisory published: 2026-04-28
Advisory updated: 2026-09-10

Who should care

Users of Apache Thrift c_glib language bindings, especially those using versions before 0.23.0, should be aware of this vulnerability. Apache Thrift users who have not upgraded to version 0.23.0 are at risk. Security teams and administrators responsible for maintaining and updating software dependencies should prioritize upgrading to the fixed version.

Technical summary

The vulnerability is caused by mismatched memory management routines in the c_glib language bindings of Apache Thrift. This can lead to a crash of the c_glib-based Thrift server when specially crafted requests are received. The error message 'free(): invalid pointer' indicates a memory management issue. The vulnerability has been assigned a CVSS score of 7.5, indicating a HIGH severity. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Defensive priority

This vulnerability has a HIGH CVSS score of 7.5 and can cause a denial of service (DoS) by crashing the server. Therefore, it is recommended to prioritize upgrading to version 0.23.0 of Apache Thrift.

Recommended defensive actions

Upgrade Apache Thrift to version 0.23.0 or later
Review and update affected systems and dependencies
Monitor for and block specially crafted requests
Implement compensating controls to mitigate potential impact
Verify and validate memory management routines in related code

Evidence notes

The CVE-2025-48431 vulnerability was published on April 28, 2026, and last modified on July 1, 2026. The vulnerability affects Apache Thrift versions before 0.23.0. The CVSS score is 7.5, indicating a HIGH severity. The CWE-762 and CWE-763 weaknesses are associated with this vulnerability.

Sources and references

Verified primary and authoritative sources

CVE-2025-48431 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2025-48431

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2025-48431 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2025-48431

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Mitigation or vendor reference
Unverified legacy reference

URL: https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql

[email protected] - Mailing List, Patch, Release Notes
Source reference
Unverified legacy reference

URL: https://access.redhat.com/errata/RHSA-2026:24539

0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source reference
Unverified legacy reference

URL: https://access.redhat.com/errata/RHSA-2026:25273

0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source reference
Unverified legacy reference

URL: https://access.redhat.com/errata/RHSA-2026:27126

0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source reference
Unverified legacy reference

URL: https://access.redhat.com/errata/RHSA-2026:28010

0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source reference
Unverified legacy reference

URL: https://access.redhat.com/security/cve/CVE-2025-48431

0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.