CVE-2025-4574: cargo-audit Double Free
CVSS: 6.5v3.1MediumDeferred
AliasesUBUNTU-CVE-2025-4574DEBIAN-CVE-2025-4574CGA-4p3w-g4f7-88wrCGA-4wpx-2c9w-6fmvCGA-542c-qmp4-3qqjCGA-5rf3-4wqj-f4p3CGA-6h38-pvmx-p636CGA-7hp9-8f74-q7xhCGA-7r4c-pf53-gh4wCGA-887v-xhf4-8x7jCGA-8wrx-p8fq-66r4CGA-8xwg-5fg8-273vCGA-9r9r-cf7q-97gwCGA-c4x2-6mxw-3x67CGA-cjx2-cmmp-46vgCGA-cm3j-r6j9-hp57CGA-fhcw-hgg7-2732CGA-fp76-ph8h-ff8mCGA-fpgr-rvjw-c8x6CGA-g2j3-q3q3-x6vxCGA-g7w4-3vgv-hm63CGA-g9p4-7vc3-f7wvCGA-ghg9-8gpw-mv2wCGA-hcwf-crw4-2wfwCGA-j3gj-xjcm-972jCGA-jcr2-6mp2-99qgCGA-p68m-2cph-x2hjCGA-pm2w-9837-jhmhCGA-pw3h-5h2c-3xm4CGA-pwr5-4g96-w6c6CGA-qcm8-5x58-h6w7CGA-r6p4-cchh-j87xCGA-vfhj-3hf2-92vcCGA-vj3f-m5q3-x465CGA-vq5h-4h8w-h425CGA-vqq2-c3ch-p8m4CGA-vrfc-24w5-9wrfCGA-vxcr-xf6f-xpxjCGA-w35x-xg6c-8w37CGA-w84g-9464-gpxmCGA-wp77-qprj-63f3CGA-x229-q6xm-627jCGA-x53f-7pp9-c5vpCGA-xr2w-v7cv-fv2ropenSUSE-SU-2026:12042-1CGA-2vxg-hmrg-j573CGA-3mrf-v8w4-gcj3CGA-52v9-7crw-8m2jCGA-7f63-3fmc-ghc8CGA-8v9g-wh96-m3gmCGA-gvq9-hgf8-8pqhCGA-hv8f-g92x-79x2CGA-jv8w-9c28-q3mwGHSA-pg9f-39pc-qf8gRUSTSEC-2025-0024TROVE-2025-013
Published 13-05-2025Last modified 30-06-2026
Vulnerability summary
CVE-2025-4574 is a medium (CVSS 6.5) Double Free vulnerability in cargo-audit. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.7% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)EPSS score
0.56%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 7 · Related 8Timeline
- 13-05-2025PublishedVulnerability first disclosed.
- 30-06-2026Last modifiedVulnerability information updated.
Description
In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.
CVSS metrics
7 scores · 7 sources · 2 versionsMedium 6.3Preferred score · OSV · Crates.io (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:NSourcesSingle source
Medium 6.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- OSV · WolfiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
EPSS trend
Probability
0.56%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
+0.02 pp
From 0.54% on 19-09-2026
19-09-202619-10-2026
EPSS score0.56%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard25 products
- cargo-audit< 0.21.2-r3
- cargo-c< 0.10.12-r1
- deno< 2.2.9-r0
- fd< 10.2.0-r2
- lychee< 0.18.1-r4
Wolfi21 products
- cargo-audit< 0.21.2-r3
- cargo-c< 0.10.12-r1
- deno< 2.2.9-r0
- fd< 10.2.0-r2
- lychee< 0.18.1-r4
Crates.Io1 product
- crossbeam-channel≥ 0.5.12, < 0.5.15 | ≥ 0.5.12-0, < 0.5.15
Debian1 product
- rust-crossbeam-channel< 0.5.15-1
Opensuse1 product
- python-ruff&distro=openSUSE Tumbleweed< 0.16.10-1.1
Ubuntu1 product
- rust-crossbeam-channelAll versions (No fix recorded)
6 vendors · 50 products
