Heap-based buffer overflow in Apache Thrift C++ bindings (CVE-2026-55971)

A heap-based buffer overflow (write) vulnerability exists in the C++ bindings of Apache Thrift, specifically in THeaderTransport::untransform() during ZLIB decompression. This vulnerability could allow an attacker to corrupt heap memory, potentially leading to arbitrary code execution or process crash. Affected versions: - Apache Thrift before 0.24.0 We recommend updating to: 0.24.0. CVSS 9.3 · our assessment: act_now Reference: https://seclists.org/oss-sec/2026/q3/271 Details: https://vuln.today/cve/CVE-2026-55971