Heap type confusion in Apache Fory C++ polymorphic deserialization (CVE-2026-71558)

A heap type confusion vulnerability in Apache Fory's C++ deserialization allows a crafted input payload to bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution. Applications not using Apache Fory C++ polymorphic smart-pointer deserialization are not affected. Affected versions: - Apache Fory 0.14.0 before 1.5.0 We recommend updating to: Apache Fory 1.5.0. CVSS 9.8 · our assessment: act_now Reference: https://lists.apache.org/thread/oywndv60jwqdv6j37t7bc1qbcc4b235r Details: https://vuln.today/cve/CVE-2026-71558