The flaw lies in Thrift's C++ THeaderTransport::readString() function, which fails to enforce bounds on the length of an information header. An attacker can provide a size field that exceeds the actual buffer capacity, allowing an out‑of‑bounds read. The data read beyond the intended limits may contain sensitive information such as memory contents of the process, leading to inadvertent disclosure.

This vulnerability affects Apache Thrift implementations prior to version 0.24.0 across all supported operating systems. Systems running the standard C++ Thrift client or server that use the THeaderTransport transport should verify their Thrift library version.

The CVSS score of 8.7 indicates a high severity. The EPSS score of 1% indicates a low but non-zero exploitation probability, and the fact that the issue is not listed in CISA's KEV catalog suggests it currently has no widely known exploits. The attack vector would likely be remote, exploiting a Thrift-enabled service over the network, though the CVE description does not provide a complete exploit chain. Attackers would need to supply a crafted request that causes the out‑of‑bounds read to succeed. The absence of external exploitation notes reduces the immediate threat, but the high CVSS and potential for confidential data leakage recommend swift remediation.