Apache Thrift CVE-2026-83632

The vulnerable code path is Thrift message deserialization, so exploitation requires the target to parse attacker-supplied Thrift protocol input, i.e., a service running Apache Thrift before 0.25.0 that accepts untrusted or remote Thrift messages. No authentication is required (PR:N) and no user interaction (UI:N), but the CVSS AC:H and AT:P metrics indicate meaningful limiting factors: the attacker must craft malformed messages that hit the integer-overflow/allocation condition, and success may depend on runtime state (heap layout, memory limits) and the specific protocol/transport in use. Services that do not expose Thrift parsing to untrusted peers (internal-only, authenticated, or non-Thrift traffic) are not reachable via this vector.

Risk is driven primarily by the memory-corruption class (CWE-770 unbounded resource allocation plus integer overflow leading to a heap-based buffer overflow) in Apache Thrift, a widely embedded RPC/serialization framework. The vendor-provided CVSS 4.0 vector (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) scores 9.2 and indicates a network-reachable, unauthenticated flaw with full high impact to confidentiality, integrity, and availability, but it is NOT trivially exploitable: AC:H and AT:P signal elevated attack complexity and specific attack requirements (e.g., crafted malformed messages and conditions outside the attacker's direct control). No EPSS probability was supplied, the CVE is NOT on CISA KEV, and no public exploit was referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical near-term risk is therefore a credible denial-of-service (resource exhaustion / crash) against services that parse untrusted Thrift input, with heap-overflow-driven code execution theoretically possible but gated by the high complexity. Signals are internally consistent (high CVSS justified by VC/VI/VA:H, tempered by AC:H/AT:P); the main tension is between the 9.2 critical score and the absence of any exploitation or EPSS evidence, which argues for prompt patching but not emergency same-day response unless the service exposes Thrift parsing to untrusted clients.

An attacker who can send Thrift protocol messages to an exposed service (for example a microservice RPC endpoint or gateway) transmits a specially crafted message whose declared sizes trigger an integer overflow and unbounded allocation, corrupting the heap during deserialization. This most reliably crashes or hangs the service (denial of service), with the heap-based buffer overflow potentially enabling memory corruption or code execution under the right conditions. No public exploit code was referenced, and the CVSS AC:H/AT:P metrics indicate non-trivial crafting is required.