CVE-2026-93925
Received Received - Intake

Stack-based Buffer Overflow in Apache Thrift C++ THeaderProtocol

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: Apache Software Foundation

Description
Stack-based buffer overflow, Incorrect bitwise shift of integer vulnerability in Apache Thrift C++ THeaderProtocol. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-93925
EUVD
EUVD-2026-91369

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache thrift to 0.25.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CWE-1335 An integer value is specified to be shifted by a negative amount or an amount greater than or equal to the number of bits contained in the value causing an unexpected or indeterminate result.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stack-based buffer overflow and incorrect bitwise shift vulnerability in Apache Thrift's C++ THeaderProtocol implementation. It allows attackers to cause memory corruption by exploiting improper handling of data sizes or shifts, potentially leading to crashes or arbitrary code execution.

Detection Guidance

Detection of this vulnerability requires checking the version of Apache Thrift installed on your system. If you are running a version before 0.25.0, your system is vulnerable. Use commands like 'thrift --version' or check package managers (e.g., 'apt list --installed | grep thrift' for Debian-based systems).

Additionally, monitor network traffic for unusual patterns or crashes in applications using Thrift, as buffer overflows may cause instability.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary code on your system, crash applications using vulnerable Thrift versions, or gain unauthorized access. Systems processing untrusted data via Thrift are at highest risk.

Compliance Impact

The vulnerability is a stack-based buffer overflow and incorrect bitwise shift in Apache Thrift C++ THeaderProtocol. This could lead to arbitrary code execution or denial of service, potentially compromising data confidentiality and integrity. Such issues may violate compliance requirements under GDPR (data protection) and HIPAA (health data security) if exploited.

Mitigation Strategies

Upgrade Apache Thrift to version 0.25.0 or later immediately. This can be done via package managers (e.g., 'apt upgrade thrift' or 'yum update thrift') or by compiling from source.

If upgrading is not immediately possible, restrict network access to Thrift services and monitor for suspicious activity until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93925. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart