CVE-2026-64608
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A heap type confusion and out-of-bounds read/write vulnerability has been discovered in the C++ implementation of Apache Fory. During deserialization in compatible mode, field-skip paths fail to properly validate declared field types against actual data, allowing inconsistent schema input to cause type confusion and out-of-bounds memory access.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized memory access, potentially leading to data leakage, system crashes, or remote code execution.
Recommendation
Upgrade Apache Fory C++ to version 1.4.0 or later immediately, as it contains the fix for this vulnerability.
Original NVD description (English source)
Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and out-of-bounds memory access. Only the C++ implementation is affected; other language implementations of Apache Fory are not. This issue affects Apache Fory C++: from 0.14.0 before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue.