AIKIDO-2026-67670
thrift is vulnerable to Out-of-bounds Write
82
High Risk
This Affects:
thriftTL;DR
THeaderTransport::readFrame() subtracts the 4-byte magic length from an attacker-supplied frame size without checking that the size is at least that large. On a 32-bit process a smaller size wraps to a huge length and the following read or write runs past the buffer. The fix rejects a frame whose declared size is smaller than the magic word before that subtraction.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run a 32-bit C++ service that accepts THeaderTransport connections from untrusted peers.
Background info
thrift is vulnerable to Out-of-bounds Write in versions 0.10.0 - 0.24.0.
How to fix this
Upgrade the thrift library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.