Apache Thrift EUVD-2026-91415

Exploitation requires the Apache Thrift C++ library built as a 32-bit binary and using THeaderTransport to parse attacker-supplied THeader-framed messages (this is the AT:P attack requirement in the CVSS 4.0 vector); 64-bit builds and services not using THeaderTransport are not affected. No authentication or user interaction is required (PR:N/UI:N) and the vulnerable code path is network-reachable (AV:N). The key limiting factor is the 32-bit build requirement, which excludes the majority of modern 64-bit deployments, and the realistic consequence is denial of service since the vendor assigns only VA:H with no confidentiality or integrity impact.

Signals are mixed and point to a moderate, availability-only concern rather than a top-tier emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) describes a network-reachable, unauthenticated flaw, but AT:P flags a required precondition and the impact metrics are the critical tell: only VA:H (availability), with VC:N and VI:N. Despite being an out-of-bounds write (CWE-191 integer underflow), the vendor scored NO confidentiality or integrity impact, implying the realistic outcome is a crash/denial of service rather than code execution - a notable contrast with the 'Buffer Overflow' tag that might suggest RCE. There is no CISA KEV listing and no EPSS score provided, so there is no evidence of active exploitation; no public exploit was identified in the supplied data. The precondition (AT:P) is the 32-bit C++ build using THeaderTransport, which materially narrows the exposed population. Net: a legitimate patch-worthy DoS issue in affected 32-bit deployments, not a widespread RCE crisis - treat as moderate priority and verify with the vendor whether memory-safety consequences could exceed the availability-only scoring.

A remote, unauthenticated attacker sends a crafted THeader-framed message to a service exposing the Apache Thrift C++ THeaderTransport compiled as a 32-bit binary. An integer underflow in length handling leads to an out-of-bounds write that crashes the server process, denying service to legitimate clients. No public proof-of-concept was identified at the time of analysis.