Apache Fory CVE-2026-60080

Exploitation requires that the target application deserializes attacker-supplied Fory-serialized data using the affected Rust deserialization logic in Fory 0.13.0-1.3.0; the concrete prerequisite is an ingestion point that accepts untrusted or externally influenced Fory payloads (RPC, messaging, cache, or file input decoded via the Rust binding). The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are needed once such an endpoint is reachable. The key limiting factors are: the deployment must actually pass untrusted input to the Rust Fory deserializer (systems that only decode trusted, internally-produced data are not realistically exposed), the affected version must be in use, and this specific defect is scoped to the Rust implementation - so services using other language bindings or that gate input behind authentication/network trust boundaries have substantially reduced real-world risk.

The CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) describes a network-reachable, low-complexity, unauthenticated flaw with low impact across confidentiality, integrity, and availability - consistent with a use-after-free that most reliably yields a crash or limited memory disclosure rather than full compromise. Countervailing that, the EPSS score is low (0.18%, 7th percentile), the CVE is not listed in CISA KEV, and no public exploit or POC is referenced, so there is no evidence of active or imminent widespread exploitation. The signals are internally consistent: high-ish CVSS driven by the unauthenticated network vector, but low real-world exploitation probability reflecting that reliable UAF weaponization (beyond a crash) is non-trivial and the product footprint is limited. Note the network vector (AV:N) is an inference about typical usage - Fory is a library, and actual exposure depends on whether a given deployment accepts untrusted serialized input over the network versus only trusted internal data; teams should verify their own data-trust boundary rather than assume remote reachability.

An attacker who can reach a service that deserializes Fory-encoded data - for example an RPC endpoint, message queue consumer, or cache loader built on the Rust binding - crafts a malformed Fory payload and submits it in place of legitimate serialized input. When the Rust deserializer processes the payload it dereferences freed memory, crashing the process (denial of service) or, in a more capable attack, returning fragments of adjacent process memory to the attacker. No public POC is referenced, and reliably turning the UAF into anything beyond a crash would require additional effort, but the low attack complexity and lack of required authentication keep the DoS path realistic.