Intel

CVE-2026-82459

thrift: Integer Underflow (Wrap or Wraparound) (CVE-2026-82459)

highEPSS 0.4%

Description

Integer underflow (wrap or wraparound), Out-of-bounds write vulnerability in Apache Thrift C++ 32 bit THeaderTransport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Source: OSV (Open Source Vulnerabilities)Microsoft Security Update Guidecvelistv5NVD (NIST)

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

bitnamithrift

Metrics

XIEM Effective CVSS
8.2
Source: cna-v4
EPSS percentile
34.9 %
Elevated — this CVE ranks above at least 10% of all CVEs scored today.
KEV status
—
Show all metrics
Severity
high
Priority score
80.73
Exploit maturity
no public PoC known
CVSS v4
8.2
EPSS score
0.4 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-10-09 10:52 UTC
CWE
CWE-191, CWE-787

Weakness classes (CWE)

  • CWE-191Base

    Integer Underflow (Wrap or Wraparound)

    The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

    cwe.mitre.org →

  • CWE-787Base

    Out-of-bounds Write

    The product writes data past the end, or before the beginning, of the intended buffer.

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-10-02 18:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-82459","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI…
  2. New CVE Received2026-10-02 12:17 UTC· security@apache.org
    • Description: Integer underflow (wrap or wraparound), Out-of-bounds write vulnerability in Apache Thrift C++ 32 bit THeaderTransport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
    • CVSS V4.0: AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
    • CWE: CWE-787
    • CWE: CWE-191