CVE-2026-41604

Modified Modified - Updated After Analysis

Out-of-Bounds Read in Apache Thrift Before

Publication date: 2026-04-28

Last updated on: 2026-06-30

Assigner: Apache Software Foundation

Description

Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-28

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2026-04-28

EPSS Evaluated

2026-07-05

NVD

CVE-2026-41604

EUVD

EUVD-2026-26022

Affected Vendors & Products

Vendor	Product	Version / Range
apache	thrift	to 0.23.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

CVE-2026-41604 is a moderate severity out-of-bounds read vulnerability affecting Apache Thrift versions prior to 0.23.0.

This vulnerability allows unauthorized access to memory outside the intended bounds, which can lead to information disclosure or application instability.

The issue is fixed in Apache Thrift version 0.23.0.

Impact Analysis

The vulnerability can lead to unauthorized access to memory outside the intended bounds.

This may result in information disclosure or cause the affected application to become unstable.

Mitigation Strategies

To mitigate the CVE-2026-41604 vulnerability in Apache Thrift, users are strongly advised to upgrade to Apache Thrift version 0.23.0 or later, as this version contains the fix for the out-of-bounds read issue.

Compliance Impact

The vulnerability is an out-of-bounds read in Apache Thrift that can lead to unauthorized access to memory outside intended bounds, potentially causing information disclosure.

Such information disclosure risks could impact compliance with data protection standards and regulations like GDPR and HIPAA, which require safeguarding sensitive data against unauthorized access.

However, the provided information does not explicitly discuss the impact of this vulnerability on compliance with these standards.

Hi! I’m here to help you understand CVE-2026-41604. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70