EUVD-2026-46174
GHSA-8g3p-5q43-955w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Untrusted deserialization gives an unauthenticated network vector (AV:N/PR:N); UAF yields limited memory disclosure, corruption, and crash, so C/I/A each Low.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
5DescriptionCVE.org
Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0.
A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
AnalysisAI
Memory disclosure and denial-of-service in Apache Fory's Rust deserialization path (versions 0.13.0 through 1.3.0) let remote attackers submit a crafted Fory-serialized payload that triggers a use-after-free, causing undefined behavior, process crashes, or leakage of adjacent process memory. The flaw affects any service that deserializes untrusted Fory data using the Rust implementation, and Apache has published a fixed release (1.4.0). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application deserializes attacker-supplied Fory-serialized data using the affected Rust deserialization logic in Fory 0.13.0-1.3.0; the concrete prerequisite is an ingestion point that accepts untrusted or externally influenced Fory payloads (RPC, messaging, cache, or file input decoded via the Rust binding). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) describes a network-reachable, low-complexity, unauthenticated flaw with low impact across confidentiality, integrity, and availability - consistent with a use-after-free that most reliably yields a crash or limited memory disclosure rather than full compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach a service that deserializes Fory-encoded data - for example an RPC endpoint, message queue consumer, or cache loader built on the Rust binding - crafts a malformed Fory payload and submits it in place of legitimate serialized input. When the Rust deserializer processes the payload it dereferences freed memory, crashing the process (denial of service) or, in a more capable attack, returning fragments of adjacent process memory to the attacker. … |
| Remediation | Vendor-released patch: upgrade Apache Fory to version 1.4.0, which fixes the use-after-free per the Apache advisory (https://lists.apache.org/thread/svnq03f3ls7vsgk8md4hjmmw1z6stbvy and https://seclists.org/oss-sec/2026/q3/193). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all applications and infrastructure components using Apache Fory versions 0.13.0 through 1.3.0, prioritizing services deserializing untrusted external data. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Fory
View allRemote code execution risk in Apache Fory (the Java serialization framework formerly known as Fury) before 1.4.0 arises
Insecure deserialization in Apache Fory's PyFory (Python) library allows remote attackers to bypass DeserializationPolic
Same weakness CWE-416 – Use After Free
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today