This vulnerability is an integer overflow in the Swift Compact Protocol implementation of Apache Thrift, affecting all releases before 0.23.0. The overflow flaw can cause unbounded memory allocation or corruption when the protocol processes malformed input, potentially leading to program crashes, denial of service, or other adverse effects if the memory corruption is not mitigated.

The flaw resides in the Apache Thrift library distributed by the Apache Software Foundation. All Thrift components built from versions prior to 0.23.0 are affected. No specific operating system or distribution dependencies are listed.

The EPSS score of < 1% indicates a very low exploitation probability, and the CVSS score of 7.3 reflects a high severity. The vulnerability is not listed in the CISA KEV catalog, and no public exploits have been reported. The likely attack vector is remote, targeting a Thrift service that accepts Swift Compact Protocol messages; local exploitation would require the attacker to reach a service bound to a trusted network. Exploitation would involve sending oversized or malformed protocol data to trigger an integer overflow that could cause memory corruption or a crash. The lack of public exploits suggests that attackers must craft custom attacks and that the vulnerability is not yet automated.