CVE-2026-58662

CVE-2026-58662 is a critical out-of-bounds read vulnerability in Apache Thrift's C++ protocol parser, stemming from improper validation of size, count, or length fields embedded in Thrift's binary wire format during deserialization. The CWE classification 'Improper Validation of Specified Quantity' is the key descriptor—this is not a generic input handling bug but a protocol-layer flaw where the C++ bindings accept a size value that exceeds either the allocated buffer or the remaining bytes in the message stream. This is fundamentally different from integer overflows in loop counters; it requires the attacker to control the serialized Thrift payload itself. The CVSS 9.1 reflects realistic severity because the vulnerability lives in a trust boundary—Thrift's deserializer. In production environments where Thrift services communicate across network boundaries or through message queues, a malicious server or compromised upstream service can send a crafted payload that triggers the OOB read, potentially exposing heap memory, session tokens, or internal application state. The attack surface includes any C++ Thrift endpoint accepting connections from untrusted clients, or services consuming Thrift messages from shared queues or service meshes where trust boundaries may be weaker than assumed. Your immediate actions: First, determine whether any C++ Thrift services in your environment run versions prior to 0.24.0—this is the patched release. Second, audit the network topology: which Thrift endpoints accept connections from outside your immediate trust domain, and do any internal services speak Thrift to third-party or partner systems? Third, treat this as a network perimeter issue, not merely a library update—old serialized messages in queues, cached state, or logs could remain exploitable even after patching if an attacker had already injected malicious payloads. A critical open question is whether other Thrift language bindings (Python, Java, Go) have the same validation gap in their container parsing logic. The C++ fix in 0.24.0 addresses this implementation, but if the same size-field validation pattern exists independently in other bindings, a malicious service could still exploit C++ clients from a correctly-patched non-C++ server. Treat this CVE as a signal to audit your entire Thrift ecosystem, not just the C++ components.

Reviewed through automated stages and approved by a human before publication.