CVE-2026-64609criticalCWE-125

CVE-2026-64609: falha crítica em Apache Fory

Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization

Publicada em

Seguir esta CVE+ Monitorar Apache Fory

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 0.8%
Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected. This issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were published under the Maven coordinates org.apache.fury:fury-core. Users are recommended to upgrade to version 1.4.0, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Produtos afetados
Apache Software Foundation · Apache Fory
CVEs relacionadas — Apache Fory

No mesmo produto, das mais perigosas para as menos.

CVE-2025-61622CRITICALApache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyforyEPSS 49.0%CVE-2026-71558CRITICALApache Fory: Heap type confusion in C++ polymorphic smart-pointer deserializationEPSS 1.0%CVE-2026-64608CRITICALApache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip pathsEPSS 0.8%CVE-2026-71559HIGHApache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadataEPSS 0.8%CVE-2026-64606CRITICALApache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interfaceEPSS 0.8%CVE-2026-71560CRITICALApache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-pathEPSS 0.8%