CVE-2026-64608
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A heap type confusion and out-of-bounds read/write vulnerability has been discovered in the C++ implementation of Apache Fory. During deserialization in compatible mode, field-skip paths fail to properly validate declared field types against actual data, allowing inconsistent schema input to cause type confusion and out-of-bounds memory access.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized memory access, potentially leading to data leakage, system crashes, or remote code execution.
Recommendation
Upgrade Apache Fory C++ to version 1.4.0 or later immediately, as it contains the fix for this vulnerability.
Other vulnerabilities in Apache Fory
See all- CVE-2026-71558Critical
Heap type confusion vulnerability in Apache Fory C++ deserialization. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution.
- CVE-2026-64606Critical
A deserialization of untrusted data vulnerability in Apache Fory allows class-registration checks to be bypassed during Java lambda deserialization. Only the lambda capture class is affected.
- CVE-2026-64609Critical
An out-of-bounds read vulnerability was found in Apache Fory (formerly Apache Fury) via sun.misc.Unsafe. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. This feature is opt-in, so applications not using it are unaffected.
- CVE-2026-48207Critical
Apache Fory PyFory before version 1.0.0 has a deserialization vulnerability in ReduceSerializer that can bypass DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data in Python-native mode with strict mode disabled.
- CVE-2026-71559High
Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This issue affects Apache Fory from version 0.16.0 before 1.5.0. Users of other language implementations are not affected.
- CVE-2026-60080High
Use-After-Free vulnerability in Rust deserialization logic of Apache Fory versions 0.13.0 through 1.3.0. A crafted Fory payload can cause undefined behavior, process crash, or potential memory disclosure.
Original NVD description (English source)
Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and out-of-bounds memory access. Only the C++ implementation is affected; other language implementations of Apache Fory are not. This issue affects Apache Fory C++: from 0.14.0 before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue.