CVE-2026-71560

⛔ critical

Summary

Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service. Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications that do not use Apache Fory C++

Description

Out-of-bounds Read vulnerability in Apache Fory C++ deserialization.

This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service.

Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications that do not use Apache Fory C++ or do not use tagged integer fields are not affected.

CVSS Score

9.1

Critical

EPSS Score

0.6

Exploit Probability

Published Date

2026-08-07

First Seen: 2026-08-08

📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 87.6% of all 361,609 vulnerabilities in our database.

#44,876

Top 25% most severe

Severity Percentile

🎯 CISA SSVC Assessment Updated: Aug 7, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Total

Complete system compromise possible

🏆 Discovered By

Zhixi "Jace Sun", independent security researcher (reporter)

SSVC data provided by CISA

Last Modified 2026-08-08

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CWE IDs (Weakness Types)

CWE-502 CWE-125

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-71558	⛔ critical	9.8	0.7	Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from ...	2026-08-07
CVE-2026-71559	⚠️ high	7.5	0.6	Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a de...	2026-08-07
CVE-2026-64608	⛔ critical	9.8	0.5	Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compa...	2026-07-21
CVE-2026-64609	⛔ critical	9.1	0.5	Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVa...	2026-07-21
CVE-2026-64606	⛔ critical	9.8	0.6	Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lamb...	2026-07-21
CVE-2026-60080	⚠️ high	7.3	0.4	Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13....	2026-07-21

CVE-2026-71560

Summary

Description

📊 Relative Risk Intelligence

🎯 CISA SSVC Assessment Updated: Aug 7, 2026

📦 Affected Products 1

🔗 References 2

🔗 Related CVEs 6