High [CVE-2026-55971] Apache Thrift C++ bindings: Remote code execution via heap-based buffer overflow

Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0.

Users are recommended to upgrade to version 0.24.0, which fixes the issue. A remote, unauthenticated attacker can exploit a heap-based buffer overflow vulnerability without user interaction.

This can lead to arbitrary code execution, allowing the attacker to gain full control over the affected system, compromise data, and cause a denial of service.

Red Hat ships the affected C++ package (thrift) in RHEL AI and in the Fedora/EPEL community distributions, and it is also consumed by AIPCC's PyArrow build pipeline (tracked separately as AIPCC-28667); upgrade to Apache Thrift 0.24.0 or later to remediate.

Confirmed usage in RHEL AI 3.4's GPU bootc images and in the AIPCC PyArrow build pipeline is limited to PyArrow's Parquet metadata support, which serializes structs via Thrift's TCompactProtocol directly to an in-memory buffer and does not invoke THeaderTransport.

As a result, this usage does not expose the vulnerable code path to network input; it would require local access to a maliciously crafted Parquet file instead.

Affected products named by the advisory: Red Hat Enterprise Linux AI 3.4 for RHEL 9; Red Hat Enterprise Linux AI 3.5 for RHEL 9; Red Hat Enterprise Linux AI 3.6 for RHEL 9; Red Hat Hardened Images; and 1 more.