The vulnerability is an out‑of‑bounds read in Apache Thrift’s C++ JSON parser. The flaw allows a decoding of serialized data to read memory beyond the bounds of a buffer, potentially exposing internal structures or sensitive data. The associated weakness is CWE‑125, indicating that unvalidated bounds are used when accessing memory.

Systems running Apache Thrift prior to version 0.23.0 are affected. This includes all deployments that rely on the distributed serialization library for cross‑language communications. The CVSS score of 6.5 indicates a moderate risk, and the impact is a direct leak of confidential information.

The exploitation requires an attacker to provide crafted JSON input that is parsed by Thrift on the target system. No public exploit is documented, and the EPSS score is < 1%. The vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 6.5 indicates a moderate risk, and while the likelihood of active exploitation remains low given the very low EPSS, the potential for sensitive data exposure remains significant.