CVE-2026-64606

CriticalCVSS 9.8

Published: 21/07/2026(UTC)Updated: 27/07/2026(UTC)Translated: 22/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.53%

41th percentile - higher than 41% of all known CVEs

Summary

A deserialization of untrusted data vulnerability in Apache Fory allows class-registration checks to be bypassed during Java lambda deserialization. Only the lambda capture class is affected.

Risk Assessment

An attacker can remotely execute arbitrary code or perform deserialization attacks, leading to compromise of confidentiality, integrity, or availability of the system.

Recommendation

Immediately upgrade Apache Fory to version 1.4.0, which fixes the vulnerability.

Original NVD description (English source)

Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected This issue affects Apache Fory: from before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue.