CVE WatchSep 10, 2026

CVE-2025-48431

Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.2

CVSS

7.5

High

EPSS

1.1%

p65

KEV

—

Exploit Today

0-100

Published: Apr 28, 2026 · Last modified: Sep 10, 2026 · CWE-762 · CWE-763

EPSS · 30d

0.7%EPSS · 30 days1.1%

2026-09-232026-10-20

Technical description

Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal "free(): invalid pointer" error message.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-112893—

20.4%

——6Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0.1d CVE-2026-689085.3 MED

37.9%

——11libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, Reporting_RCBWriteAccessHandler accepts an RptID longer than 129 bytes in the report-control-block write path. When GI later causes sendNextReportEntrySegment to serialize the report, the function wraps rptIdBuf[130] as a temporary MmsValue and passes it to MmsValue_setVisibleString. The setter's resize path frees the stack-backed buffer, allowing a remote client to trigger an invalid free and server crash by writing the oversized RptID and then generating a report. This issue is fixed in version 1.6.2.5d CVE-2026-1020257.5 HIG

38.6%

——12A Mismatched Memory Management Routines vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker to cause a denial of service via a BGP route update when extended next-hop tunneling and SRv6 service processing are used.5d CVE-2026-970118.8 HIG

53.2%

——16Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.6d CVE-2026-858507.8 HIG

26.5%

——8Release of invalid pointer or reference in Windows Kernel allows an authorized attacker to elevate privileges locally.8d CVE-2026-853627.0 HIG

15.6%

——5Release of invalid pointer or reference in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.5d