The vulnerability is an out‑of‑bounds read in Apache Thrift's skip() function for Swift ranges. Reading beyond the allocated buffer can cause memory corruption, trigger a crash, and potentially expose data that should not be accessible.

Apache Thrift, versions prior to 0.23.0, as released by the Apache Software Foundation.

The CVSS score of 8.2 indicates a high severity vulnerability, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. The likely attack vector is through a remote Thrift client sending a crafted message to a parser that invokes skip(). Successful exploitation could lead to a denial of service or leakage of sensitive memory content, but no active exploits have been reported.