← Vulnerability feed

Vulnerability record · CVE-2026-71558 · published 7 August 2026

CVE-2026-71558: Apache fory deserialization of untrusted data vulnerability

Apache · Fory

Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution. Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications not using Apache Fory C++ polymorphic smart-pointer deserialization are not affected.

9.8 CVSS 3.1 Critical EPSS 0.99% · top 39.0% CWE-502 · Deserialization of untrusted dataCWE-843 · Type confusion
9.8CVSS 3.1 base score
0.99%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
8 Aug 2026Last modified by NVD

Description

Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution. Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications not using Apache Fory C++ polymorphic smart-pointer deserialization are not affected.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://lists.apache.org/thread/oywndv60jwqdv6j37t7bc1qbcc4b235r Mailing ListVendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/07/3 Mailing ListThird Party Advisory

Track CVE-2026-71558 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-64606Apache fory deserialization of untrusted data vulnerabilityDeserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lamb…EPSS 0.78%9.8CVE-2026-64608Apache fory deserialization of untrusted data vulnerabilityHeap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip pa…EPSS 0.81%9.8CVE-2026-48207Apache fory deserialization of untrusted data vulnerabilityDeserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks dur…EPSS 0.82%9.8CVE-2025-61622Apache fory deserialization of untrusted data vulnerabilityDeserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows…EPSS 44%9.1CVE-2026-71560Apache fory deserialization of untrusted data vulnerabilityOut-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deseri…EPSS 0.77%9.1CVE-2026-64609Apache fory out-of-bounds read vulnerabilityOut-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the b…EPSS 0.78%9.1CVE-2026-50076Apache fory deserialization of untrusted data vulnerabilityDeserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remo…EPSS 0.74%7.5CVE-2026-71559Apache fory deserialization of untrusted data vulnerabilityDeserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying …EPSS 0.80%

Source: NIST National Vulnerability Database (record CVE-2026-71558), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.