CVE-2026-41604

HighCVSS 8.2/10Last modified Sep 9, 2026

Description

Out-of-bounds Read vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Apr 28, 2026
Last modified
Sep 9, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-416057.3Integer Overflow or Wraparound vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to uCVE-2026-416065.3Uncontrolled Recursion vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade tCVE-2026-416076.5Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to veCVE-2026-416087.5Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. This issue affects Apache CVE-2026-41614.4The Review Map by RevuKangaroo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up CVE-2026-416105.0Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker tCVE-2026-416113.3Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execuCVE-2026-416125.5Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally.CVE-2026-416138.8Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.CVE-2026-416146.2Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally.CVE-2026-416157.4Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose informatioCVE-2026-41627.1The Gravity SMTP plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.4. This is due to the plu
CVE-2026-41604: High severity, CVSS 8.2 | Vulnix