CVE-2026-66081

HighCVSS 8.7/10Last modified Oct 2, 2026

Description

Access of Uninitialized Pointer vulnerability in Apache Thrift c_glib bindings.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Metrics

CVSS 4.0 8.7/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-824

Affected software

VendorProductVersions
Apache Software FoundationApache Thrift< 0.25.0

References

Timeline

Published
Oct 2, 2026
Last modified
Oct 2, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-660826.5An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow sCVE-2026-660836.5The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoCVE-2026-660848.1An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are CVE-2026-660855.5In modem, there is a possible information disclosure due to missing filtering of sensitive data in crash dumps. This could lead to local infCVE-2026-660869.8In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messageCVE-2026-660878.1An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are noCVE-2026-660889.4In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands withouCVE-2026-660896.1In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. ThisCVE-2026-66096.3A flaw has been found in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function form_valid of the file oauth/views.py. CVE-2026-660907.1In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create CVE-2026-660916.9In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthentCVE-2026-660924.8In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation.