EUVD-2026-54422
GHSA-rwv5-p9fv-c8fp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated once the polymorphic path is exposed (AV:N/PR:N), but reliable exploitation of heap type confusion into code execution is build-dependent and feature-gated, so AC:H; full C/I/A impact on the process.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Heap type confusion vulnerability in Apache Fory C++ deserialization.
This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution.
Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications not using Apache Fory C++ polymorphic smart-pointer deserialization are not affected.
Articles & Coverage 1
AnalysisAI
Heap type confusion in the Apache Fory C++ deserialization engine (versions 0.14.0 up to but not including 1.5.0) lets a crafted payload bypass type-compatibility checks during polymorphic smart-pointer deserialization, so an object of an incompatible type is handled as its declared base type. Because CWE-502 untrusted-data handling here corrupts memory rather than merely mis-parsing values, an attacker who controls serialized input can trigger undefined behavior ranging from denial of service to arbitrary code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The application must actively use Apache Fory C++ polymorphic smart-pointer deserialization (deserializing base-class smart pointers such as shared_ptr/unique_ptr where the concrete type is chosen from the payload) on input an attacker can control - the vendor explicitly states applications not using this feature are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a service a Fory-serialized payload that declares a polymorphic smart pointer to some base class but embeds a type descriptor for an incompatible concrete type, slipping past the compatibility check. On deserialization the C++ runtime constructs and dispatches through the wrong object layout, corrupting the heap; in the simplest case this crashes the service (DoS), and with a carefully engineered payload the type confusion could be steered toward arbitrary code execution. … |
| Remediation | Vendor-released patch: upgrade Apache Fory to 1.5.0, which contains the fix, per the Apache advisory (https://lists.apache.org/thread/oywndv60jwqdv6j37t7bc1qbcc4b235r) and the oss-security announcement (http://www.openwall.com/lists/oss-security/2026/08/07/3). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems using Apache Fory versions 0.14.0 through 1.4.x and identify which ones process untrusted serialized input. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Fory
View allRemote code execution risk in Apache Fory (the Java serialization framework formerly known as Fury) before 1.4.0 arises
Insecure deserialization in Apache Fory's PyFory (Python) library allows remote attackers to bypass DeserializationPolic
Denial of service in the Go implementation of Apache Fory allows unauthenticated remote attackers to crash affected serv
Memory disclosure and denial-of-service in Apache Fory's Rust deserialization path (versions 0.13.0 through 1.3.0) let r
Out-of-bounds heap read in Apache Fory C++ versions 0.14.0 through 1.4.x allows attackers supplying crafted deserializat
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today