CVEFinder.io

CVE-2026-71558

⛔ critical
🔍 Scan for this CVE
Summary

Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution. Users are recommended to upgrade to Apache Fory 1.5.0,

Description

Heap type confusion vulnerability in Apache Fory C++ deserialization.

This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution.


Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications not using Apache Fory C++ polymorphic smart-pointer deserialization are not affected.

CVSS Score
9.8
Critical
EPSS Score
0.7
Exploit Probability
Published Date
2026-08-07
First Seen: 2026-08-08
📊 Relative Risk Intelligence

This CVE is Very High Risk - more severe than 90.5% of all 361,609 vulnerabilities in our database.

#34,236
Top 10% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: Aug 7, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
YES
Can be exploited automatically
💥 Technical Impact
Total
Complete system compromise possible
🏆 Discovered By
Zhixi "Jace Sun", independent security researcher (reporter)
SSVC data provided by CISA
Last Modified 2026-08-08
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)
CWE-502 CWE-843

📦 Affected Products 1

Vendor Product Status Affected Versions
apache fory Affected
> 0.14.0 < 1.5.0

🔗 References 2

https://lists.apache.org/thread/oywndv60jwqdv6j37t7b...
Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/07/3
Mailing List Third Party Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-71559 ⚠️ high 7.5 0.6 Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a de... 2026-08-07
CVE-2026-71560 ⛔ critical 9.1 0.6 Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0... 2026-08-07
CVE-2026-64608 ⛔ critical 9.8 0.5 Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compa... 2026-07-21
CVE-2026-64609 ⛔ critical 9.1 0.5 Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVa... 2026-07-21
CVE-2026-64606 ⛔ critical 9.8 0.6 Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lamb... 2026-07-21
CVE-2026-60080 ⚠️ high 7.3 0.4 Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.... 2026-07-21
These CVEs affect the same products