CVE-2026-41604 is an out-of-bounds read vulnerability in Apache Thrift, affecting all versions prior to 0.23.0. This vulnerability allows an attacker to read memory outside the intended bounds, which can lead to information disclosure (confidentiality impact) and cause a denial of service (availability impact). The vulnerability has a CVSS 3.1 base score of 8.2, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and unchanged scope. Red Hat advisories confirm the vulnerability and recommend upgrading to version 0.23.0 where the issue is fixed.

The vulnerability can be exploited remotely without authentication or user interaction, potentially allowing attackers to read sensitive memory contents and cause denial of service conditions. The confidentiality impact is low, but the availability impact is high. There are no known exploits in the wild at this time.

A fix is available by upgrading Apache Thrift to version 0.23.0 or later. Users should apply this official update to remediate the vulnerability. Red Hat has issued security advisories referencing this CVE and providing updated packages. Patch status is confirmed by vendor advisories.