CVE-2026-66081

{
  "etk_id": "ETK-2026-617",
  "cve_id": "CVE-2026-66081",
  "display_id": "CVE-2026-66081",
  "ghsa_id": "GHSA-v446-56hp-jpw2",
  "euvd_id": "EUVD-2026-91588",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Uninitialized pointer access in Apache Thrift c_glib bindings",
  "summary": "Apache Thrift c_glib bindings before 0.25.0 are affected by an uninitialized pointer access issue. The available evidence does not establish what an attacker can do or the preconditions required to trigger the issue.",
  "mitigation": "Upgrade Apache Thrift c_glib bindings to version 0.25.0 or later.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Thrift",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 0.25.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "0.25.0"
      ],
      "package_name": "c_glib bindings",
      "purl": null
    }
  ],
  "cwes": [
    824
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0043,
  "epss_percentile": 0.3551,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 13.460584733333333,
  "t0_at": "2026-10-02T12:33:13.645000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-02T12:33:13.645000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T12:33:13.645000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66081"
    }
  }
}