Apache Thrift c_glib: NULL pointer dereference crashes multiplexed processor
Summary
Apache Thrift c_glib bindings before 0.25.0 contain a NULL pointer dereference and use of an uninitialized variable. A remote, unauthenticated attacker can send a message that the c_glib multiplexed processor cannot route, causing the service to crash. The impact is limited to denial of service; no confidentiality or integrity impact is documented. Only services built on Thrift c_glib with the multiplexed processor that accept network connections are relevant.
Affected
- Apache Thrift c_glib bindings, versions before 0.25.0
- Distribution packages based on Thrift 0.24.0 or earlier, for example Azure Linux thrift 0.24.0-1
Fixed in
- Apache Thrift 0.25.0 (vendor-recommended upgrade)
- Distribution packages: check your distribution's advisory for the fixed package version
Workaround
- No workaround documented by the vendor.
- Interim measure: restrict network access to the Thrift service to trusted networks until the upgrade is applied.
Exploitation
- No reports of exploitation in the wild known.
- No public proof of concept found.
- CISA SSVC: Exploitation none, automatable yes, technical impact partial.
- EPSS 0.00316 (low predicted exploitation probability).
Our recommendation
- Check whether any service uses Thrift c_glib with the multiplexed processor.
- If such a service is reachable from untrusted networks, upgrade to Apache Thrift 0.25.0 or the fixed distribution package.
- If the component is internal-only or not present, the risk is low; monitor for service crashes in the meantime.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Thrift 0.25.0 changelog apache.googlesource.com
- Apache Thrift download page thrift.apache.org
- OSV/Bitnami record BIT-thrift-2026-66859 osv.dev
- Azure Linux OSV record AZL-106590 osv.dev
- Apache list thread 33otcgbqd27wf6qq810q56znzbomnhg1 lists.apache.org
- Apache list thread n9rogg2166hl9y4ycq5njpvnxndr8y5o lists.apache.org
- Vulners CVE record CVE-2026-66859 vulners.com
- SUSE CVE aggregator record CVE-2026-66859 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:52.
Original description (NVD)
NULL Pointer Dereference, Use of Uninitialized Variable vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.