Apache Fory EUVD-2026-31292

Exploitation requires that the target application (1) deserializes attacker-controlled data using PyFory's Python-native serialization mode, (2) has strict mode DISABLED, and (3) relies on DeserializationPolicy to restrict unsafe classes, functions, or module attributes - the exact control that ReduceSerializer bypasses. The malicious payload must reach a ReduceSerializer reduce-state restoration or global-name resolution path. Limiting factors: applications running with strict mode enabled, not using Python-native mode, not exposing deserialization to untrusted input, or not depending on DeserializationPolicy as a security boundary are not exploitable; this is a non-default, security-configuration-dependent condition rather than a flaw in every PyFory deployment, which is consistent with the very low EPSS despite the 9.8 CVSS.

Signals conflict and must be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) and SSVC (Automatable: yes, Technical Impact: total) point to a severe, easily weaponizable deserialization-to-RCE class of bug. However, EPSS is only 0.04% (13th percentile), SSVC Exploitation is 'none', it is not in CISA KEV, and no POC has surfaced - so real-world exploitation is currently unobserved. Critically, the raw CVSS AC:L understates a real precondition: the target application must be deserializing attacker-controlled data in Python-native mode WITH strict mode disabled AND relying on DeserializationPolicy as its safety net. That non-default, security-dependent configuration meaningfully narrows the exposed population, so this is best treated as a high-priority patch for teams actually using PyFory's policy-based sandboxing, rather than an internet-wide emergency. Note the tension: CVSS marks AC:L/PR:N but the description implies a specific insecure configuration is required - verify your deployment mode before prioritizing.

An application uses PyFory in Python-native mode with strict mode disabled and depends on DeserializationPolicy to block dangerous classes while deserializing data received over the network (e.g., a cache, message queue, or API payload). An attacker submits a crafted serialized blob whose reduce-state or global-name resolution references a disallowed callable; because ReduceSerializer skips the policy hook, the object is reconstructed and attacker-controlled code executes in the application's context. No public POC has been identified, but SSVC rates the attack as automatable with total technical impact.