CVE-2026-55971

CriticalCVSS 9.8

Published: 27/07/2026(UTC)Updated: 28/07/2026(UTC)Translated: 27/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.04%

61th percentile - higher than 61% of all known CVEs

Summary

Apache Thrift versions before 0.24.0 contain a heap-based buffer overflow vulnerability in the C++ bindings, potentially leading to crashes or remote code execution.

Risk Assessment

An attacker could crash the service or execute arbitrary code in the context of the Thrift process, potentially compromising system integrity.

Recommendation

Update Apache Thrift to version 0.24.0 or later.

Original NVD description (English source)

Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.