Apache Thrift CVE-2025-48431

Requires Apache Thrift server implementation using c_glib language bindings specifically. Servers using Java, Python, C++, Go, Node.js, or other Thrift language bindings are NOT vulnerable. Target server must accept network connections (AV:N) from attacker. No authentication required (PR:N) - publicly accessible c_glib Thrift endpoints are directly exploitable. No user interaction needed (UI:N) - purely server-side vulnerability. Default configurations of vulnerable c_glib Thrift servers are exploitable without special setup. Attack is limited by targeting c_glib binding usage, which represents a subset of total Apache Thrift deployments - many organizations use Java or Python bindings instead, naturally limiting exposure scope.

CVSS 7.5 indicates high severity with network-accessible attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N), suggesting easy remote exploitation. However, real-world risk signals paint a different picture. EPSS score of 0.02% (4th percentile) suggests extremely low probability of exploitation in the wild, indicating this is not being actively targeted despite theoretical ease. Not present in CISA KEV, confirming no known active exploitation. Impact is limited to availability (A:H) with no confidentiality or integrity impact (C:N/I:N), making this purely a denial-of-service issue. The vulnerability only affects systems using the c_glib language bindings specifically - Python, Java, C++, and other language bindings are not vulnerable. SSVC assessment: exploitation status is none, automatable (network/low complexity), technical impact is partial (DoS only). Prioritize mitigation for production c_glib Thrift servers exposed to untrusted networks; lower priority for internal-only or non-c_glib deployments. The disparity between CVSS severity and EPSS probability suggests this is a valid but not urgent patch unless running exposed c_glib Thrift services.

Remote attacker crafts malicious Thrift RPC requests with payloads designed to trigger memory management mismatches in c_glib deserialization routines. Upon receipt, the vulnerable Thrift server attempts to free memory using an incompatible deallocation function, causing glibc to detect the invalid pointer and terminate the process with 'free(): invalid pointer' error. The server crashes immediately, denying service to legitimate users. Attacker can repeat requests to sustain denial of service. No public POC identified at time of analysis, but CVSS AC:L indicates straightforward exploitation once request structure is understood.