EUVD-2026-46171
GHSA-wh2x-66qr-23v8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable unauthenticated deserialization (AV:N/PR:N), but AC:H because it needs compatible-mode config plus a crafted mismatched-schema payload to reliably corrupt the heap; full memory-safety impact gives C/I/A:H.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
5DescriptionCVE.org
Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and out-of-bounds memory access. Only the C++ implementation is affected; other language implementations of Apache Fory are not.
This issue affects Apache Fory C++: from 0.14.0 before 1.4.0.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Articles & Coverage 1
AnalysisAI
Memory corruption in Apache Fory's C++ serialization library (versions 0.14.0 up to but not including 1.4.0) lets remote attackers trigger heap type confusion and out-of-bounds read/write by supplying data with an inconsistent schema when deserialization runs in compatible mode. Because the field-skip code paths never validate declared field types against the actual bytes, a crafted payload can corrupt heap memory, creating a path toward remote code execution or denial of service. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the CWE-502 root cause and 9.8 CVSS score make it a high-priority patch for any service that deserializes untrusted input with the C++ implementation.
Technical ContextAI
Apache Fory (formerly Fury) is a high-performance multi-language serialization framework used to encode and decode object graphs for RPC, caching, and big-data pipelines; only its C++ implementation is affected here, while Java, Python, Go and other bindings are not. The flaw sits in 'compatible mode,' the schema-evolution mode where the reader may encounter fields it does not recognize and must skip them. The field-skip logic trusts the type declared in the incoming stream rather than reconciling it against the expected/actual data, so a mismatched type tag causes the reader to interpret bytes as the wrong type (heap type confusion) and to index outside allocated buffers (out-of-bounds read/write). This maps to CWE-502 (Deserialization of Untrusted Data): the deserializer reconstructs state from attacker-controlled input without sufficient validation, and in an unmanaged C++ context that manifests as direct memory-safety violations rather than logic-level object injection.
RemediationAI
Vendor-released patch: 1.4.0 - upgrade the Apache Fory C++ library to 1.4.0 or later, which corrects the field-skip type validation; this is the primary and recommended fix per the Apache advisory (https://lists.apache.org/thread/wl05slf57zzoq1s4pg4tk6nx6mjyjr4b). If you cannot upgrade immediately, the most effective compensating control is to avoid deserializing untrusted or externally-sourced data with the affected C++ builds, and specifically to disable or avoid compatible mode where the schema-evolution path is not strictly required, since compatible mode is the code path that reaches the vulnerable field-skip logic (trade-off: you lose cross-version schema flexibility and may break clients that rely on evolving schemas). Additionally restrict which network sources can submit serialized payloads to affected services (network ACLs / authentication in front of the deserialization endpoint), accepting that this only narrows the attack surface rather than closing the flaw. Confirm the vuldb record (https://vuldb.com/vuln/380833) and vendor thread for any updated guidance.
Pickle deserialization RCE in pyfory 0.12.0-0.12.2 and pyfury 0.1.0-0.10.3.
Unsafe deserialization in Apache Fory fory-core Java SDK versions prior to 1.1.0 allows remote attackers to bypass the f
Out-of-bounds memory read in Apache Fory (formerly Apache Fury) versions 0.5.0 up to 1.4.0 allows remote attackers to re
A vulnerability in Apache Fory allows a remote attacker to cause a Denial of Service (DoS). Rated medium severity (CVSS
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today