Apache Thrift c_glib Uninitialized Pointer (before 0.25.0)
CVE-2026-66081 Published on October 2, 2026
Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messages
Access of Uninitialized Pointer vulnerability in Apache Thrift c_glib bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Vulnerability Analysis
CVE-2026-66081 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Access of Uninitialized Pointer
The program accesses or uses a pointer that has not been initialized.
Products Associated with CVE-2026-66081
Want to know whenever a new CVE is published for Apache Thrift? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Thrift:- Before 0.25.0 is affected.