PT-2026-104326

CVE-2026-83632

Published

2026-10-02

Updated

2026-10-09

Description by

CVSS 4.0

9.2

Critical

MetricsAV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0

Description Apache Thrift contains an issue involving the allocation of resources without limits or throttling, integer overflow or wraparound, and a heap-based buffer overflow. A heap-based buffer overflow occurs when a program writes more data to a heap memory buffer than it can hold, potentially leading to crashes or arbitrary code execution.

Recommendations Upgrade to version 0.25.0.

Exploitability

Fix

Impacts

Researchers

Ho1Aas

Vendors

Affected products

Weakness enumeration

CWE-122: Heap-based Buffer Overflow

CWE-770: Allocation of Resources Without Limits or Throttling

CWE-190: Integer Overflow or Wraparound