EUVD-2026-54422
GHSA-rwv5-p9fv-c8fp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated once the polymorphic path is exposed (AV:N/PR:N), but reliable exploitation of heap type confusion into code execution is build-dependent and feature-gated, so AC:H; full C/I/A impact on the process.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
6DescriptionCVE.org
Heap type confusion vulnerability in Apache Fory C++ deserialization.
This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution.
Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications not using Apache Fory C++ polymorphic smart-pointer deserialization are not affected.
Articles & Coverage 1
AnalysisAI
Heap type confusion in the Apache Fory C++ deserialization engine (versions 0.14.0 up to but not including 1.5.0) lets a crafted payload bypass type-compatibility checks during polymorphic smart-pointer deserialization, so an object of an incompatible type is handled as its declared base type. Because CWE-502 untrusted-data handling here corrupts memory rather than merely mis-parsing values, an attacker who controls serialized input can trigger undefined behavior ranging from denial of service to arbitrary code execution. This is rated CVSS 9.8 and is fixed in 1.5.0; there is no public exploit identified at time of analysis and EPSS is low at 0.21%.
Technical ContextAI
Apache Fory (formerly Fury) is a cross-language, high-performance serialization framework; the affected component is its C++ runtime. The flaw is a CWE-502 (Deserialization of Untrusted Data) defect that manifests as heap type confusion: during polymorphic deserialization of smart pointers (e.g. std::shared_ptr/unique_ptr to a base class), Fory is supposed to verify that the concrete type in the payload is compatible with the declared base type before constructing it. The bug allows that check to be bypassed, so bytes describing one type are interpreted through the vtable/layout of an incompatible type. In C++ this breaks memory-safety invariants - mismatched object layouts, invalid vtable dispatch, and unsafe pointer reinterpretation - which is the classic path from type confusion to controlled memory corruption. Only code paths that use Fory's polymorphic smart-pointer deserialization exercise the vulnerable logic.
RemediationAI
Vendor-released patch: upgrade Apache Fory to 1.5.0, which contains the fix, per the Apache advisory (https://lists.apache.org/thread/oywndv60jwqdv6j37t7bc1qbcc4b235r) and the oss-security announcement (http://www.openwall.com/lists/oss-security/2026/08/07/3). If you cannot upgrade immediately, the most direct compensating control is to stop deserializing untrusted or externally-sourced payloads through Fory's polymorphic smart-pointer path, since applications that do not use that feature are not affected - where feasible, avoid polymorphic (base-class smart-pointer) deserialization of attacker-influenced data and use concrete non-polymorphic types, at the cost of losing polymorphic serialization functionality. Additionally, restrict and authenticate the network sources that can submit serialized data and validate/whitelist expected message sources upstream so that untrusted input never reaches the deserializer; note these controls reduce exposure but do not remove the underlying bug, so they are stopgaps until 1.5.0 is deployed. Cite only version 1.5.0 as the confirmed fixed release.
More in Apache Fory
View allRemote code execution risk in Apache Fory (the Java serialization framework formerly known as Fury) before 1.4.0 arises
Insecure deserialization in Apache Fory's PyFory (Python) library allows remote attackers to bypass DeserializationPolic
Denial of service in the Go implementation of Apache Fory allows unauthenticated remote attackers to crash affected serv
Memory disclosure and denial-of-service in Apache Fory's Rust deserialization path (versions 0.13.0 through 1.3.0) let r
Out-of-bounds heap read in Apache Fory C++ versions 0.14.0 through 1.4.x allows attackers supplying crafted deserializat
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today