vulnerabilityCVE-2026-66081

Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messages

Access of Uninitialized Pointer vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Severity

8.7High

Exploitation evidence

None confirmed

Remediation

Fixed in 0.25.0

Affected software

Software	Affected versions	Fixed in	Sources

CVSS (Common Vulnerability Scoring System)

Preferred assessment

Vector

Attack vector

Attack complexity

Privileges required

User interaction

Scope

Confidentiality impact

Integrity impact

Availability impact

Source assessments

EPSS (Exploit Prediction Scoring System)

Probability

Percentile

Model

Preferred remediation

Action