CVE-2025-4574

The crossbeam-channel crate is a fundamental Rust concurrency primitive that provides multi-producer, multi-consumer message-passing channels. The vulnerability resides in the Drop trait implementation of the internal Channel type, which manages cleanup of channel state and associated resources. CWE-415 (Double Free) occurs when a memory location is freed more than once, leading to heap corruption and potential code execution. The race condition in the Drop method likely stems from unsynchronized access to reference counts or channel state during concurrent cleanup operations, particularly when multiple threads attempt to drop the same channel resources simultaneously without proper synchronization primitives. This is especially critical in Rust's memory-safe language context, where unsafe code blocks are required to implement such low-level concurrency primitives, and improper synchronization can bypass Rust's borrow checker guarantees.