EUVD-2026-46171
GHSA-wh2x-66qr-23v8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable unauthenticated deserialization (AV:N/PR:N), but AC:H because it needs compatible-mode config plus a crafted mismatched-schema payload to reliably corrupt the heap; full memory-safety impact gives C/I/A:H.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and out-of-bounds memory access. Only the C++ implementation is affected; other language implementations of Apache Fory are not.
This issue affects Apache Fory C++: from 0.14.0 before 1.4.0.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Articles & Coverage 1
AnalysisAI
Memory corruption in Apache Fory's C++ serialization library (versions 0.14.0 up to but not including 1.4.0) lets remote attackers trigger heap type confusion and out-of-bounds read/write by supplying data with an inconsistent schema when deserialization runs in compatible mode. Because the field-skip code paths never validate declared field types against the actual bytes, a crafted payload can corrupt heap memory, creating a path toward remote code execution or denial of service. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application uses the Apache Fory C++ implementation (versions 0.14.0 to before 1.4.0) AND performs deserialization in 'compatible mode' on data the attacker can influence - compatible mode is the specific configuration whose field-skip paths contain the flaw. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) describes a remote, unauthenticated, low-complexity flaw with total impact, which on its face is a top-tier priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a serialized Fory payload with deliberately mismatched field type tags to a network service that deserializes untrusted input using the Apache Fory C++ library in compatible mode. The field-skip path misinterprets the declared types, producing heap type confusion and an out-of-bounds write that the attacker grooms toward memory corruption, potentially achieving code execution or crashing the service. … |
| Remediation | Vendor-released patch: 1.4.0 - upgrade the Apache Fory C++ library to 1.4.0 or later, which corrects the field-skip type validation; this is the primary and recommended fix per the Apache advisory (https://lists.apache.org/thread/wl05slf57zzoq1s4pg4tk6nx6mjyjr4b). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running Apache Fory versions 0.14.0 through 1.3.x, prioritizing those processing external data or exposed to the internet. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today