EUVD-2026-54421
GHSA-r6vj-r3jc-f9gp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Network-reachable deserializer with no auth required; OOB read yields only low confidentiality and low availability impact, no integrity effect.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds Read vulnerability in Apache Fory C++ deserialization.
This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service.
Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications that do not use Apache Fory C++ or do not use tagged integer fields are not affected.
Articles & Coverage 1
AnalysisAI
Out-of-bounds heap read in Apache Fory C++ versions 0.14.0 through 1.4.x allows attackers supplying crafted deserialization payloads to trigger information disclosure or denial of service. The flaw resides specifically in the tagged integer fast-path deserializer and only manifests when the application processes structs with tagged integer fields. No public exploit or active exploitation has been identified at time of analysis, and a vendor-released patch is available in version 1.5.0.
Technical ContextAI
Apache Fory is a high-performance multi-language serialization framework under the Apache Software Foundation (CPE: cpe:2.3:a:apache_software_foundation:apache_fory:*). The vulnerability lies in the C++ implementation's deserialization path for tagged integer fields, where an optimized 'fast-path' routine performs an out-of-bounds heap read when processing a specially crafted payload. CWE-502 (Deserialization of Untrusted Data) identifies the root cause class: the library reads attacker-controlled data without sufficient bounds checking in this specific code path. The OOB read is on the heap, meaning adjacent heap memory can be disclosed to the caller or trigger a crash. This is distinct from a write primitive; no memory corruption or code execution path has been described.
RemediationAI
Upgrade Apache Fory C++ to version 1.5.0, which contains the vendor-released fix for this issue per the Apache advisory at https://lists.apache.org/thread/xl2g544kctbgozccnj35qts43p452y5x. If an immediate upgrade is not feasible, the primary compensating control is to avoid deserializing data from untrusted sources using the C++ binding - restrict Fory deserialization to data originating from trusted internal systems only. A second option is to avoid defining or processing structs with tagged integer fields until the patch is applied; this eliminates the vulnerable code path entirely but may require application-level schema changes. No side effects are anticipated from the version 1.5.0 upgrade based on available information, though integration testing against existing serialized data formats is advisable as part of any serialization library upgrade.
More in Apache Fory
View allRemote code execution risk in Apache Fory (the Java serialization framework formerly known as Fury) before 1.4.0 arises
Heap type confusion in the Apache Fory C++ deserialization engine (versions 0.14.0 up to but not including 1.5.0) lets a
Insecure deserialization in Apache Fory's PyFory (Python) library allows remote attackers to bypass DeserializationPolic
Denial of service in the Go implementation of Apache Fory allows unauthenticated remote attackers to crash affected serv
Memory disclosure and denial-of-service in Apache Fory's Rust deserialization path (versions 0.13.0 through 1.3.0) let r
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today