Out-of-bounds read in Apache Fory zero-copy Java deserialization (CVE-2026-64609)

Apache Fory contains an out-of-bounds read vulnerability via `sun.misc.Unsafe` in its zero-copy deserialization path. When out-of-band zero-copy deserialization is enabled, the `readAlignedVarUint()` method can read beyond the bounds of the underlying buffer. Only applications that opt in to out-of-band zero-copy deserialization are affected. Affected versions: - Apache Fory (org.apache.fory:fory-core) 0.11.0 before 1.4.0 - Apache Fory (org.apache.fury:fury-core) 0.5.0 before 0.11.0 We recommend updating to: 1.4.0. CVSS 9.1 · our assessment: act_now Reference: https://seclists.org/oss-sec/2026/q3/196 Details: https://vuln.today/cve/CVE-2026-64609