CVE-2026-41605

HighCVSS 7.3/10Last modified Sep 9, 2026

Description

Integer Overflow or Wraparound vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-190

Affected software

No affected versions have been published.

Timeline

Published
Apr 28, 2026
Last modified
Sep 9, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-416065.3Uncontrolled Recursion vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade tCVE-2026-416076.5Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to veCVE-2026-416087.5Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. This issue affects Apache CVE-2026-41614.4The Review Map by RevuKangaroo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up CVE-2026-416105.0Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker tCVE-2026-416113.3Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execuCVE-2026-416125.5Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally.CVE-2026-416138.8Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.CVE-2026-416146.2Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally.CVE-2026-416157.4Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose informatioCVE-2026-41627.1The Gravity SMTP plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.4. This is due to the pluCVE-2026-41639.8A vulnerability was detected in Wavlink WL-WN579A3 220323. This issue affects the function SetName/GuestWifi of the file /cgi-bin/wireless.c
CVE-2026-41605: High severity, CVSS 7.3 | Vulnix