CVE-2026-41607
Out-of-Bounds Read in Apache Thrift Before
Publication date: 2026-04-28
Last updated on: 2026-04-28
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | thrift | to 0.23.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-41607 is an out-of-bounds read vulnerability in Apache Thrift versions prior to 0.23.0.
This security flaw allows unauthorized reading of memory outside the intended bounds.
Such unauthorized memory access can lead to information disclosure or cause application instability.
The issue is fixed in Apache Thrift version 0.23.0.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive information by allowing attackers to read memory outside the intended boundaries.
It may also cause instability or crashes in applications using affected versions of Apache Thrift.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-41607 vulnerability, users are strongly advised to upgrade Apache Thrift to version 0.23.0 or later, as this version contains the fix for the out-of-bounds read issue.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The out-of-bounds read vulnerability in Apache Thrift prior to version 0.23.0 can potentially lead to unauthorized reading of memory outside intended bounds, which may result in information disclosure.
Such unauthorized information disclosure could impact compliance with data protection standards and regulations like GDPR and HIPAA, which require safeguarding sensitive data against unauthorized access.
Therefore, failing to address this vulnerability by not upgrading to the fixed version 0.23.0 could increase the risk of non-compliance with these regulations.