CVE-2026-64608: fallo crítico en Apache Fory
Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.8epss 0.8%
Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and out-of-bounds memory access. Only the C++ implementation is affected; other language implementations of Apache Fory are not.
This issue affects Apache Fory C++: from 0.14.0 before 1.4.0.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Apache Software Foundation · Apache ForyCVEs relacionadas — Apache Fory
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-61622CRITICALApache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyforyEPSS 49.0%CVE-2026-71558CRITICALApache Fory: Heap type confusion in C++ polymorphic smart-pointer deserializationEPSS 1.0%CVE-2026-71559HIGHApache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadataEPSS 0.8%CVE-2026-64606CRITICALApache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interfaceEPSS 0.8%CVE-2026-64609CRITICALApache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserializationEPSS 0.8%CVE-2026-71560CRITICALApache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-pathEPSS 0.8%