CVE-2026-66859
Received Received - Intake

NULL Pointer Dereference in Apache Thrift c_glib Bindings

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: Apache Software Foundation

Description
NULL Pointer Dereference, Use of Uninitialized Variable vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-66859
EUVD
EUVD-2026-91584

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache thrift to 0.25.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-457 The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a NULL pointer dereference and use of an uninitialized variable in Apache Thrift's c_glib bindings. It affects versions before 0.25.0 and could lead to crashes or unexpected behavior in applications using these bindings.

Detection Guidance

Detection involves checking the version of Apache Thrift c_glib bindings. Use commands like 'thrift --version' or inspect installed packages via package managers (e.g., 'dpkg -l | grep thrift' for Debian/Ubuntu). If the version is before 0.25.0, the system is vulnerable.

Impact Analysis

The vulnerability may cause application crashes, data corruption, or denial of service due to NULL pointer dereference or uninitialized variable misuse. Systems relying on Apache Thrift c_glib bindings are at risk until patched.

Compliance Impact

This vulnerability involves NULL pointer dereference and use of uninitialized variables in Apache Thrift c_glib bindings, which could lead to crashes or undefined behavior in applications. Such issues may impact data integrity and availability, potentially affecting compliance with standards like GDPR (data integrity requirements) and HIPAA (availability and integrity of protected health information).

Mitigation Strategies

Upgrade Apache Thrift to version 0.25.0 or later immediately. Follow official upgrade instructions for your system. If upgrading is not possible, consider disabling affected c_glib bindings or isolating vulnerable systems until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66859. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart