The vulnerability arises from mismatched memory management routines in the c_glib language bindings of Apache Thrift. An attacker can send specially crafted requests that trigger a free(): invalid pointer exception, causing the server to crash and become unavailable, which constitutes a denial‑of‑service flaw. The flaw does not directly expose data or allow privilege escalation. The likely attack vector is an unauthenticated network request to a Thrift c_glib service, implying that any host that can reach the service can potentially exploit the issue.

Apache Thrift servers that use the c_glib bindings, specifically all releases before version 0.23.0, are impacted. The vendor is the Apache Software Foundation and the product is Apache Thrift.

The CVSS score of 7.5 indicates a high severity impact. The EPSS score of < 1% suggests exploitation likelihood is low, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, any publicly exposed Thrift service can be targeted with a simple malformed request, meaning that the condition for exploitation is minimal. The combination of a high‑severity crash and low exploitation probability leads to a moderate overall risk assessment.