CVE-2026-64609
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
An out-of-bounds read vulnerability was found in Apache Fory (formerly Apache Fury) via sun.misc.Unsafe. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. This feature is opt-in, so applications not using it are unaffected.
Risk Assessment
An attacker could exploit this vulnerability to read sensitive data from memory or cause unexpected application behavior, potentially leading to information disclosure or system integrity compromise.
Recommendation
Upgrade Apache Fory to version 1.4.0 immediately, which fixes the issue. If upgrading is not possible, disable the out-of-band zero-copy deserialization feature.
Original NVD description (English source)
Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected. This issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were published under the Maven coordinates org.apache.fury:fury-core. Users are recommended to upgrade to version 1.4.0, which fixes the issue.