Mismatched Memory Management Routines

The product attempts to return a memory resource to the system, but it calls a release function that is not compatible with the function that was originally used to allocate that resource.

CVEs (12)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2025-48431 1Apache 1Thrift Jul 22, 2026 Apr 28, 2026 N/A· v4 7.5 HIGH· v3 N/A· v2 Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue....Show more Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal "free(): invalid pointer" error message.Show less
CVE-2025-11015 - - Jun 17, 2026 Sep 26, 2025 1.9 LOW· v4 5.3 MEDIUM· v3 4.3 MEDIUM· v2 A weakness has been identified in OGRECave Ogre up to 14.4.1. Impacted is the function STBIImageCodec::encode of the file /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp. This manipulation causes mismatched memory manageme...Show more A weakness has been identified in OGRECave Ogre up to 14.4.1. Impacted is the function STBIImageCodec::encode of the file /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp. This manipulation causes mismatched memory management routines. The attack is restricted to local execution. The exploit has been made available to the public and could be exploited.Show less
CVE-2025-49080 1Absolute 1Secure Access Jun 17, 2026 Jun 12, 2025 8.7 HIGH· v4 7.5 HIGH· v3 N/A· v2 There is a memory management vulnerability in Absolute Secure Access server versions 9.0 to 13.54. Attackers with network access to the server can cause a Denial of Service by sending a specially crafted sequence of pack...Show more There is a memory management vulnerability in Absolute Secure Access server versions 9.0 to 13.54. Attackers with network access to the server can cause a Denial of Service by sending a specially crafted sequence of packets to the server. The attack complexity is low, there are no attack requirements, privileges, or user interaction required. Loss of availability is high; there is no impact on confidentiality or integrity.Show less
CVE-2025-48755 1Blyssprivacy 1Spiral Rs Jun 17, 2026 May 24, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 In the spiral-rs crate 0.2.0 for Rust, allocation can be attempted for a ZST (zero-sized type).
CVE-2025-47737 1Unhandledexpression 1Trailer Jun 17, 2026 May 9, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 lib.rs in the trailer crate through 0.1.2 for Rust mishandles allocating with a size of zero.
CVE-2025-20189 1Cisco 1Ios Xe Jun 17, 2026 May 7, 2025 N/A· v4 7.4 HIGH· v3 N/A· v2 A vulnerability in the Cisco Express Forwarding functionality of Cisco IOS XE Software for Cisco ASR 903 Aggregation Services Routers with Route Switch Processor 3 (RSP3C) could allow an unauthenticated, adjacent attacke...Show more A vulnerability in the Cisco Express Forwarding functionality of Cisco IOS XE Software for Cisco ASR 903 Aggregation Services Routers with Route Switch Processor 3 (RSP3C) could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition. This vulnerability is due to improper memory management when Cisco IOS XE Software is processing Address Resolution Protocol (ARP) messages. An attacker could exploit this vulnerability by sending crafted ARP messages at a high rate over a period of time to an affected device. A successful exploit could allow the attacker to exhaust system resources, which eventually triggers a reload of the active route switch processor (RSP). If a redundant RSP is not present, the router reloads.Show less
CVE-2024-32503 1Samsung 8Exynos 1080 Firmware Exynos 1280 FirmwareExynos 1330 Firmware+5 more Jun 17, 2026 Jun 7, 2024 N/A· v4 7.8 HIGH· v3 N/A· v2 An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 850, Exynos 1080, Exynos 2100, Exynos 1280, Exynos 1380, Exynos 1330, Exynos W920, Exynos W930. The mobile processor lacks proper memory d...Show more An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 850, Exynos 1080, Exynos 2100, Exynos 1280, Exynos 1380, Exynos 1330, Exynos W920, Exynos W930. The mobile processor lacks proper memory deallocation checking, which can result in a UAF (Use-After-Free) vulnerability.Show less
CVE-2024-4853 2Fedoraproject Wireshark 2Fedora Wireshark Jun 17, 2026 May 14, 2024 N/A· v4 5.5 MEDIUM· v3 N/A· v2 Memory handling issue in editcap could cause denial of service via crafted capture file
CVE-2024-2955 2Fedoraproject Wireshark 2Fedora Wireshark Jun 17, 2026 Mar 26, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 T.38 dissector crash in Wireshark 4.2.0 to 4.0.3 and 4.0.0 to 4.0.13 allows denial of service via packet injection or crafted capture file
CVE-2023-41056 2Fedoraproject Redis 2Fedora Redis Jun 17, 2026 Jan 10, 2024 N/A· v4 8.1 HIGH· v3 N/A· v2 Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overflow that leads to heap overflow and potential remote code execution. This issue...Show more Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overflow that leads to heap overflow and potential remote code execution. This issue has been patched in version 7.0.15 and 7.2.4.Show less
CVE-2023-45510 1Justdan96 1Tsmuxer Jun 17, 2026 Oct 12, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 tsMuxer version git-2539d07 was discovered to contain an alloc-dealloc-mismatch (operator new [] vs operator delete) error.
CVE-2023-3648 1Wireshark 1Wireshark Jun 17, 2026 Jul 14, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 Kafka dissector crash in Wireshark 4.0.0 to 4.0.6 and 3.6.0 to 3.6.14 allows denial of service via packet injection or crafted capture file