EUVD-2026-46172
GHSA-8w3v-jcfp-ffw5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Network-reachable and unauthenticated (AV:N/PR:N), but AC:H because it requires the non-default out-of-band zero-copy feature; OOB read yields memory disclosure (C:H) and crash (A:H) with no integrity impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected.
This issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were published under the Maven coordinates org.apache.fury:fury-core.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
AnalysisAI
Out-of-bounds memory read in Apache Fory (formerly Apache Fury) versions 0.5.0 up to 1.4.0 allows remote attackers to read beyond the underlying buffer via a flaw in readAlignedVarUint() when out-of-band zero-copy deserialization is used. Because the affected code relies on sun.misc.Unsafe for direct memory access, an attacker supplying crafted serialized data to an application that has enabled this opt-in feature can disclose adjacent heap memory or crash the process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a fix (version 1.4.0) is available and the issue was reported by the Apache security team.
Technical ContextAI
Apache Fory is a high-performance multi-language serialization framework (Java/Python/Golang/C++/etc.) used for fast object graph encoding and RPC/data-interchange, formerly published as Apache Fury under Maven coordinates org.apache.fury:fury-core before 0.11.0. The root cause is CWE-125 (Out-of-bounds Read): the readAlignedVarUint() variable-length integer decoder reads past the end of the backing buffer during out-of-band zero-copy deserialization, a mode where buffer chunks are passed alongside the main stream to avoid copying. Fory uses sun.misc.Unsafe for direct off-heap/on-heap memory access, so a missing bounds check translates into a raw memory read at an attacker-influenced offset rather than a safe exception, enabling information disclosure of adjacent memory or a memory-fault crash.
RemediationAI
Vendor-released patch: version 1.4.0 - upgrade Apache Fory (or the legacy org.apache.fury:fury-core artifact) to 1.4.0 or later, which fixes the bounds check in readAlignedVarUint(), per the Apache advisory at https://lists.apache.org/thread/rdv22ks3b0cxh0r52w3ghxgkxqso3f1b. If immediate upgrade is not possible, the most effective compensating control is to disable out-of-band zero-copy deserialization, since applications that do not use that opt-in feature are not affected; the trade-off is loss of the performance benefit of zero-copy buffer handling. Additionally, restrict and authenticate the sources permitted to send serialized Fory payloads and validate/limit buffer sizes at the transport boundary so untrusted peers cannot reach the vulnerable deserialization path.
Memory corruption in Apache Fory's C++ serialization library (versions 0.14.0 up to but not including 1.4.0) lets remote
Pickle deserialization RCE in pyfory 0.12.0-0.12.2 and pyfury 0.1.0-0.10.3.
Unsafe deserialization in Apache Fory fory-core Java SDK versions prior to 1.1.0 allows remote attackers to bypass the f
A vulnerability in Apache Fory allows a remote attacker to cause a Denial of Service (DoS). Rated medium severity (CVSS
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today