CWE-1335 vulnerabilities

CVE-2026-93925 is a high-severity stack-based buffer overflow vulnerability in the Apache Thrift C++ THeaderProtocol caused by an incorrect bitwise shift of an integer. This flaw affects Apache Thrift versions before 0.25.0. The issue has been fixed in version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.

A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.