Apache Thrift uses a C++ protocol implementation that checks how many bytes are available before a read. An integer overflow occurs in TProtocol::checkReadBytesAvailable, which allows a malformed client to cause the server to read beyond the intended buffer. The overflow can trigger a crash or unexpected behavior, leading to a denial of service or possible information disclosure. The vulnerability is classified as CVSS 8.7, indicating high severity.

The flaw affects all Apache Thrift bindings written in C++, c_glib, Go, netstd, Delphi and Haxe that use versions prior to 0.24.0. This includes any application or service that imports and executes these libraries from the Apache Software Foundation.

Because the overflow is triggered by data received over the Thrift protocol, the attack vector is network‑bound; a remote client can send crafted data to exploit the bug. The EPSS score of 1% indicates a low but non‑zero exploitation probability, and the vulnerability is not listed in CISA KEV. With a CVSS score of 8.7 the risk is high, and the likelihood of exploitation remains significant until the library is updated.