CVE-2026-41602

HighCVSS 7.5/10Last modified Sep 9, 2026

Description

Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-190

Affected software

No affected versions have been published.

Timeline

Published
Apr 28, 2026
Last modified
Sep 9, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-416048.2Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to veCVE-2026-416057.3Integer Overflow or Wraparound vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to uCVE-2026-416065.3Uncontrolled Recursion vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade tCVE-2026-416076.5Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to veCVE-2026-416087.5Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. This issue affects Apache CVE-2026-41614.4The Review Map by RevuKangaroo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up CVE-2026-416105.0Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker tCVE-2026-416113.3Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execuCVE-2026-416125.5Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally.CVE-2026-416138.8Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.CVE-2026-416146.2Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally.CVE-2026-416157.4Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose informatio
CVE-2026-41602: High severity, CVSS 7.5 | Vulnix