Heap type confusion and out-of-bounds read/write in Apache Fory C++ (CVE-2026-64608)

Apache Fory's C++ implementation contains a heap type confusion and out-of-bounds read/write vulnerability in its compatible-mode deserialization logic. Field-skip paths fail to validate declared field types against actual data, allowing input with an inconsistent schema to trigger type confusion and out-of-bounds memory access. Only the C++ implementation is affected; other language implementations of Apache Fory are not. Affected versions: - Apache Fory C++ 0.14.0 before 1.4.0 We recommend updating to: 1.4.0. CVSS 9.8 · our assessment: act_now Reference: https://seclists.org/oss-sec/2026/q3/195 Details: https://vuln.today/cve/CVE-2026-64608