Apache Thrift EUVD-2026-91369

Exploitation requires the target to be an Apache Thrift C++ service (version before 0.25.0) that uses the THeaderProtocol; services using other Thrift protocols/transports are not affected by this specific code path. Given AV:N/AC:L/PR:N/UI:N, no authentication, special privileges, or user interaction is needed, and default handling of crafted header input is sufficient to trigger the flaw - the primary limiting factors are that the vulnerable THeaderProtocol must be in use, the endpoint must be network-reachable to the attacker, and the deployed version must predate 0.25.0.

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity flaw needing no privileges or user interaction - signals that normally warrant high prioritization. However, the impact metrics are the decisive nuance: only availability is affected (VA:H) while confidentiality and integrity are rated N (VC:N/VI:N). This means the vendor scoped the issue as a remote denial-of-service (crash/hang), NOT remote code execution, even though CWE-121 stack-based buffer overflows frequently enable RCE. This is a notable tension: a stack overflow plus an incorrect integer bitwise shift would ordinarily raise RCE concern, yet the official 4.0 vector asserts no integrity or confidentiality impact - defenders should treat the no-RCE claim as vendor-assessed rather than independently proven and verify with the Apache advisory. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a real but availability-bounded priority - worth patching promptly on internet-exposed or multi-tenant Thrift C++ services, but it is a DoS exposure as scored, not a confirmed code-execution emergency.

An attacker sends a crafted THeaderProtocol message to a network-exposed Apache Thrift C++ service; the malformed header triggers an incorrect integer bitwise shift that miscomputes a size, causing a stack-based buffer overflow that crashes the server process. No authentication or user interaction is required, enabling repeated remote denial of service. No public exploit code was identified in the provided data.