Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. (CVE-2026-91135)

The vulnerability in Apache Thrift C++ THeaderTransport arises from improper handling of compressed frames when the ZLIB transform is enabled. Specifically, THeaderTransport::transform() copies the compressed frame into the write buffer without ensuring the buffer is large enough. Since some data may expand rather than compress, this results in a heap-based buffer overflow where data is written beyond the allocated buffer size. This overflow can grow with the size of the frame and may also cause reads past the end of the transform buffer. The issue affects Apache Thrift versions prior to 0.25.0, with the fix implemented in version 0.25.0.

This vulnerability allows an attacker to cause a heap-based buffer overflow by sending specially crafted frames that expand under compression. The overflow can lead to memory corruption, potentially resulting in application crashes or arbitrary code execution. The CVSS vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. However, no known exploits are reported in the wild.

Users should upgrade Apache Thrift to version 0.25.0 or later, where this heap-based buffer overflow vulnerability is fixed. No other mitigations are indicated or recommended by the vendor advisory.