CVE-2026-64609
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
An out-of-bounds read vulnerability was found in Apache Fory (formerly Apache Fury) via sun.misc.Unsafe. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. This feature is opt-in, so applications not using it are unaffected.
Risk Assessment
An attacker could exploit this vulnerability to read sensitive data from memory or cause unexpected application behavior, potentially leading to information disclosure or system integrity compromise.
Recommendation
Upgrade Apache Fory to version 1.4.0 immediately, which fixes the issue. If upgrading is not possible, disable the out-of-band zero-copy deserialization feature.
Other vulnerabilities in Apache Fory
See all- CVE-2026-71558Critical
Heap type confusion vulnerability in Apache Fory C++ deserialization. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution.
- CVE-2026-64606Critical
A deserialization of untrusted data vulnerability in Apache Fory allows class-registration checks to be bypassed during Java lambda deserialization. Only the lambda capture class is affected.
- CVE-2026-64608Critical
A heap type confusion and out-of-bounds read/write vulnerability has been discovered in the C++ implementation of Apache Fory. During deserialization in compatible mode, field-skip paths fail to properly validate declared field types against actual data, allowing inconsistent schema input to cause type confusion and out-of-bounds memory access.
- CVE-2026-48207Critical
Apache Fory PyFory before version 1.0.0 has a deserialization vulnerability in ReduceSerializer that can bypass DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data in Python-native mode with strict mode disabled.
- CVE-2026-71559High
Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This issue affects Apache Fory from version 0.16.0 before 1.5.0. Users of other language implementations are not affected.
- CVE-2026-60080High
Use-After-Free vulnerability in Rust deserialization logic of Apache Fory versions 0.13.0 through 1.3.0. A crafted Fory payload can cause undefined behavior, process crash, or potential memory disclosure.
Original NVD description (English source)
Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected. This issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were published under the Maven coordinates org.apache.fury:fury-core. Users are recommended to upgrade to version 1.4.0, which fixes the issue.