Apache Fory C++ Heap Type Confusion and OOB R/W (<=1.3)
CVE-2026-64608 Published on July 21, 2026

Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths
Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and out-of-bounds memory access. Only the C++ implementation is affected; other language implementations of Apache Fory are not. This issue affects Apache Fory C++: from 0.14.0 before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Vendor Advisory NVD

Weakness Types

What is an Object Type Confusion Vulnerability?

The program allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

CVE-2026-64608 has been classified to as an Object Type Confusion vulnerability or weakness.

What is a Memory Corruption Vulnerability?

The software writes data past the end, or before the beginning, of the intended buffer. Typically, this can result in corruption of data, a crash, or code execution. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent write operation then produces undefined or unexpected results.

CVE-2026-64608 has been classified to as a Memory Corruption vulnerability or weakness.

What is a Marshaling, Unmarshaling Vulnerability?

The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

CVE-2026-64608 has been classified to as a Marshaling, Unmarshaling vulnerability or weakness.


Products Associated with CVE-2026-64608

Want to know whenever a new CVE is published for Apache Fory? stack.watch will email you.

 

Affected Versions

Apache Software Foundation Apache Fory: