EUVD-2026-54421
GHSA-r6vj-r3jc-f9gp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Network-reachable deserializer with no auth required; OOB read yields only low confidentiality and low availability impact, no integrity effect.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds Read vulnerability in Apache Fory C++ deserialization.
This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service.
Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications that do not use Apache Fory C++ or do not use tagged integer fields are not affected.
Articles & Coverage 1
AnalysisAI
Out-of-bounds heap read in Apache Fory C++ versions 0.14.0 through 1.4.x allows attackers supplying crafted deserialization payloads to trigger information disclosure or denial of service. The flaw resides specifically in the tagged integer fast-path deserializer and only manifests when the application processes structs with tagged integer fields. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application uses the Apache Fory C++ binding (not the Java or other language bindings), processes structs containing tagged integer fields during deserialization, and accepts serialized input from an attacker-controlled source. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS vector was provided by NVD or the vendor at time of analysis, so all risk metrics are independently assessed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with the ability to supply a crafted serialized payload to an application using Apache Fory C++ sends a malformed struct payload containing tagged integer fields designed to trigger the fast-path deserializer's out-of-bounds read. The read leaks adjacent heap memory back to the attacker (if the application reflects or logs deserialization output) or crashes the process, causing a denial of service. … |
| Remediation | Upgrade Apache Fory C++ to version 1.5.0, which contains the vendor-released fix for this issue per the Apache advisory at https://lists.apache.org/thread/xl2g544kctbgozccnj35qts43p452y5x. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Fory
View allRemote code execution risk in Apache Fory (the Java serialization framework formerly known as Fury) before 1.4.0 arises
Heap type confusion in the Apache Fory C++ deserialization engine (versions 0.14.0 up to but not including 1.5.0) lets a
Insecure deserialization in Apache Fory's PyFory (Python) library allows remote attackers to bypass DeserializationPolic
Denial of service in the Go implementation of Apache Fory allows unauthenticated remote attackers to crash affected serv
Memory disclosure and denial-of-service in Apache Fory's Rust deserialization path (versions 0.13.0 through 1.3.0) let r
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today