This vulnerability allows an out‑of‑bounds read while processing header frames in the Apache Thrift C++ library. The bug is classified as CWE‑126 and could expose memory contents that should not be revealed, potentially leaking sensitive data stored on the heap. The flaw does not provide code execution or denial‑of‑service capabilities, but it can compromise the confidentiality of information exchanged by applications using Thrift.

Apache Thrift C++ bindings before version 0.24.0 are affected. Any application or service that incorporates these bindings and processes Thrift frames may be vulnerable until the library is upgraded.

The CVSS base score of 6.9 indicates a medium severity vulnerability. EPSS score of < 1% indicates a very low probability of exploitation, but the risk cannot be precisely quantified. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the likely attack vector is remote, with a malicious actor able to send crafted Thrift messages to a vulnerable server to trigger the out‑of‑bounds read. Being a heap read, the risk of successful data leakage increases with larger or more complex payloads. Because the flaw exists in the network leg of the protocol stack, all externally reachable Thrift endpoints are potential attack vectors, assuming no mitigating network controls.