The vulnerability is an out-of-bounds read in the c_glib bindings of Apache Thrift, specifically within the transport leftover-bytes path. This flaw, categorized as CWE-125, can expose internal memory contents to an attacker, resulting in accidental disclosure of sensitive data. While the official description does not state additional repercussions, the nature of an out-of-bounds read inherently threatens confidentiality and, if exploited in conjunction with other flaws, could potentially aid further compromise.

Apache Thrift versions before 0.24.0 are affected. The issue exists in the c_glib bindings of the Apache Software Foundation's Thrift library. Any deployment that relies on these bindings without the latest patch is vulnerable.

The CVSS score of 6.9 indicates a high risk level. The EPSS score is 1%, indicating a low but nonzero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation is not currently documented. The attack vector is not explicitly detailed in the advisory; however, the out-of-bounds read could be triggered by processing untrusted data through the affected transport layer. Exploitation likely requires the attacker to supply crafted input that causes the transport to read beyond allocated memory. While remote exploitation is possible if the Thrift service is exposed to untrusted clients, local exploitation would be easier if the service runs with sufficient privileges.