The flaw occurs in the Dart bindings of Apache Thrift, where the TBinaryProtocol.readMessageBegin function allocates memory based on a pre‑versioned name length. Because the length parameter is not properly validated, an attacker can send a crafted request that causes the function to allocate an excessive amount of memory. The resulting heap exhaustion or buffer overflow can crash the service, leading to a denial of service. The vulnerability is associated with typical size validation and allocation weaknesses and is identified by CWE-130, CWE-770, and CWE-789.

Apache Thrift versions prior to 0.25.0 that use the Dart bindings are vulnerable. Any deployment exposing the Thrift Dart interface that has not applied the 0.25.0 release is at risk. The issue does not affect the Java or C++ bindings.

With a CVSS score of 8.7 the vulnerability poses a high risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by sending a malformed Thrift message over a network connection. Because the allocation depends on a length field that the server trusts, a remote client can instruct the server to allocate an arbitrarily large buffer or an invalid size, which can lead to out‑of‑memory errors or a crash. The exploitation requires the target to have the vulnerable Dart bindings exposed to untrusted input.