A heap-based buffer overflow exists in Apache Thrift’s C++ THeaderTransport::transform() routine. When a frame is processed with the ZLIB transform enabled, the routine copies the compressed frame into a write buffer without validating the compressed size. Frames that fail to compress well grow during compression, causing the copy to write beyond the end of the heap buffer and, for large frames, to read past the transform buffer’s boundary. This unchecked memory corruption can allow an attacker to overwrite data on the heap, potentially leading to arbitrary code execution or a service crash.

All applications built with Apache Thrift prior to version 0.25.0 are affected. Any service that enables the ZLIB transform for frames it sends and accepts untrusted Thrift traffic from external peers is potentially vulnerable.

The CVSS score of 9.2 indicates a high severity flaw, while the EPSS score of less than 1% shows a presently low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw over the network by sending large, poorly compressing frames to the target, without needing authentication, and thereby trigger the out‑of‑bounds write for potential remote code execution or denial of service.