Apache Thrift CVE-2026-91135

Exploitation requires the application to have ENABLED the ZLIB transform for frames it sends via THeaderTransport (a non-default, deployment-specific configuration), AND the attacker must be able to get poorly-compressible data (e.g. high-entropy, remote-peer-supplied content) placed into a transmitted frame so it expands under compression; larger frames worsen both the heap over-write and an out-of-bounds read of the transform buffer. Limiting factors: if the ZLIB write transform is not configured, the vulnerable copy path is not reached; impact scales with frame size, and reliable code execution (versus a crash) depends on heap layout. The CVSS vector is PR:N (unauthenticated) and UI:N (no user interaction), so no credentials or victim action are needed once the ZLIB transform precondition holds. Affected: Apache Thrift C++ before 0.25.0; remediated in 0.25.0.

This is a credible high-priority issue but NOT an automatic emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 9.2 CRITICAL and indicates network-reachable, unauthenticated triggering with full CIA impact (VC:H/VI:H/VA:H) to the vulnerable system - consistent with a remotely triggerable heap-based buffer overflow (CWE-122) in a widely-used RPC framework. The key tempering signal is AT:P (Attack Requirements: Present): exploitation is conditional on the application enabling the ZLIB transform for frames it SENDS, and on supplying data that does not compress well (grows under compression). This is a non-default, deployment-specific precondition, so the raw 9.2 overstates risk for the typical Thrift deployment that does not use the ZLIB write transform. Exploitation status: no public exploit identified at time of analysis - the CVE is NOT in CISA KEV and no POC is referenced; only the two Apache mailing-list advisories are provided. EPSS score was not supplied, so exploitation probability cannot be quantified. There is no SSVC decision data provided. In short: a serious memory-corruption flaw that warrants prompt patching where the ZLIB transform is enabled, but absent KEV/POC/EPSS evidence this is 'high-CVSS, conditional-real-risk' rather than confirmed widespread exploitation. Note the AT:P condition should be verified against each environment's Thrift configuration.

A service built on Apache Thrift C++ (before 0.25.0) is configured to apply the ZLIB transform to outgoing THeaderTransport frames. A remote peer sends high-entropy, poorly-compressible content that the server echoes or forwards into a frame; when THeaderTransport::transform() compresses it, the data expands and is copied into the write buffer without a bounds check, overflowing the heap and (for large frames) also over-reading the transform buffer. No public exploit code is currently identified, but the network-reachable, unauthenticated nature makes controlled heap corruption and potential remote code execution a realistic objective for a motivated attacker.