Apache Thrift EUVD-2026-91403

Exploitation requires that the target application was built using the Apache Thrift c_glib (C/GLib) language bindings specifically - other language bindings (Java, Python, C++, Go, etc.) are not implicated by this advisory, which sharply limits the affected population. The flaw affects Thrift versions before 0.25.0. The CVSS AT:P metric signals that a specific attack requirement/condition must be present for the uninitialized-resource/wrong-status-code path to trigger (e.g., a particular request sequence or protocol state), so exploitation is not guaranteed against every c_glib deployment. No authentication is required (PR:N) and no user interaction (UI:N), and the vector is network-reachable (AV:N); the primary limiting factors are the narrow c_glib binding requirement, the AT:P trigger condition, and the low technical impact (memory-disclosure/error-state only, no integrity impact).

This is a moderate, not a top-priority, issue. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes a network-reachable, unauthenticated flaw with no user interaction, but with only Low confidentiality and Low availability impact (VC:L/VA:L) and, critically, AT:P - meaning a specific attack requirement/condition must be met for exploitation, which tempers the otherwise favorable AV:N/PR:N signals. The 6.3 (Medium) score reflects that limited impact rather than severe compromise: consistent with CWE-908 (use of uninitialized resource) plus a wrong-status-code return, this points to information disclosure of uninitialized memory and/or incorrect error-handling state, not code execution or integrity loss (VI:N). There is NO CISA KEV listing and NO EPSS score or POC indicator in the provided data, so there is no evidence of active exploitation or public exploit code - exploitation status is therefore: no public exploit identified at time of analysis. Key missing data to note explicitly: no EPSS probability was supplied, so widespread-exploitation likelihood cannot be quantified; and the AT:P 'attack requirement' is not described in detail in the advisory text provided, so the precise triggering condition should be verified against the two Apache mailing-list advisories before prioritization.

A remote, unauthenticated attacker interacts with a Thrift-based RPC service whose server or client was built using the Apache Thrift c_glib (C/GLib) bindings, and under a specific protocol/state condition triggers the use of an uninitialized resource, causing the service to leak fragments of uninitialized memory in a response or to return an incorrect status code that mishandles the request. No public exploit code is identified at time of analysis, and the AT:P metric indicates a particular condition must hold for the flaw to trigger.