What is the CVSS score of CVE-2025-4574?

CVE-2025-4574 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2025-4574?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

CVE-2025-4574

MEDIUM

Double Free (CWE-415)

2025-05-13 secalert@redhat.com

Buffer Overflow

6.5

CVSS 3.1 · Vendor: redhat

View

Vulnerability Assessment

Weakness	CWE CWE-415 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Double free prevention
Impact	While the CVSS score of 6.5 indicates moderate severity with network-accessible attack vector (AV:N), low complexity (AC:L), and no privileges required (PR:N), the EPSS score of 0.38% (59th percentile) suggests low real-world exploitation probability. The vulnerability represents a genuine code-execution risk through memory corruption (integrity and availability impact: I:L, A:L), but exploitation requires specific race condition timing and application architecture. The lack of any identified public exploit code, combined with the low EPSS percentile, indicates this is not currently a priority target despite the dangerous nature of double-free vulnerabilities. However, the widespread adoption of crossbeam-channel in production Rust systems means patches should be prioritized for defense-in-depth. The race condition's nature means exploitation is non-deterministic and may not be reliably weaponizable, reducing practical threat likelihood. SSVC considerations suggest this warrants timely patching but does not require emergency response unless running in security-critical infrastructure.
Exploit ScenarioDerived	An attacker controlling a networked Rust application could trigger a race condition in the Channel Drop method by crafting network messages or application inputs that cause concurrent channel cleanup operations across multiple threads, potentially inducing a double-free condition that corrupts heap memory. Once memory corruption occurs, subsequent operations on corrupted heap structures could lead to code execution, though reliable exploitation would require precise timing and knowledge of heap layout. No public proof-of-concept has been identified, making practical exploitation unlikely for most threat actors without significant engineering effort.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 26, 2026

Double-free vulnerability in crossbeam-channel Rust crate's Channel Drop implementation allows memory corruption via a race condition during cleanup, affecting remote network applications that depend on this widely-used concurrency library. The vulnerability requires no authentication or user interaction and can be triggered by unauthenticated remote attackers in networked Rust applications using vulnerable versions. No public exploit code has been identified at the time of analysis, though the issue presents a moderate real-world risk due to the library's prevalence in production Rust ecosystems and the EPSS score of 0.38% indicating low exploitation likelihood.

RemediationAI

Update crossbeam-channel to the patched version released to address pull request #1187. Users should run 'cargo update crossbeam-channel' to pull the latest secure version, or explicitly update their Cargo.toml to the corrected version once released by the maintainers. Verify the patch by reviewing the upstream pull request at https://github.com/crossbeam-rs/crossbeam/pull/1187 for specific fixed version numbers. For organizations unable to immediately upgrade, implement additional runtime thread-safety auditing and avoid patterns that trigger rapid concurrent channel drops, though no complete workaround exists for the underlying race condition. Consult the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2025-4574 and GitHub Advisory GHSA-pg9f-39pc-qf8g for distribution-specific patch availability.

Affected Packages

cargo crossbeam-channel fix: 0.5.15

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in cargo

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The crossbeam-channel crate is a fundamental Rust concurrency primitive that provides multi-producer, multi-consumer message-passing channels. The vulnerability resides in the Drop trait implementation of the internal Channel type, which manages cleanup of channel state and associated resources. CWE-415 (Double Free) occurs when a memory location is freed more than once, leading to heap corruption and potential code execution. The race condition in the Drop method likely stems from unsynchronized access to reference counts or channel state during concurrent cleanup operations, particularly when multiple threads attempt to drop the same channel resources simultaneously without proper synchronization primitives. This is especially critical in Rust's memory-safe language context, where unsafe code blocks are required to implement such low-level concurrency primitives, and improper synchronization can bypass Rust's borrow checker guarantees.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

SUSE MEDIUM

Red Hat 6.5 MEDIUM

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

May 13, 2025 - 22:15 nvd

MEDIUM 6.5

DescriptionCVE.org

In crossbeam-channel rust crate, the internal Channel type's Drop method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.

Executive ViewAI

Why It Matters

CVE-2025-4574 presents notable security risk rated CVSS 6.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Moderate

Compensating Controls

Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.

Threat Intelligence Overview

EPSS Score

0.4%

Top 41% exploitable

Data Quality

6 sources

Confidence: High

NVD

CVE.org

EPSS Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.4%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +32

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Same weakness CWE-415 – Double Free

View all

CVE-2014-0502 HIGH POC

8.8

CVE-2018-0101 CRITICAL POC

10.0

CVE-2023-25136 MEDIUM POC

6.5

CVE-2026-33824 CRITICAL POC

9.8

CVE-2014-1767 HIGH POC

7.2

CVE-2016-5768 CRITICAL POC

9.8

CVE-2016-5772 CRITICAL POC

9.8

CVE-2016-3132 CRITICAL POC

9.8

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Container suse/sl-micro/6.1/base-os-container:2.2.0-4.54 Image SL-Micro Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd	Affected
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0	Fixed
openSUSE Leap 15.6	Fixed
openSUSE Leap 16.0	Fixed
openSUSE Tumbleweed	Fixed

References

Advisories & patches

ADVISORY https://vuldb.com/?id.308815 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:01591/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20096/ REF https://access.redhat.com/security/cve/CVE-2025-4574 REF https://bugzilla.redhat.com/show_bug.cgi?id=2358890 REF https://github.com/advisories/GHSA-pg9f-39pc-qf8g REF https://github.com/crossbeam-rs/crossbeam/pull/1187

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back