CVE-2026-60080CWE-416

Apache Fory: Rust MetaString heap use-after-free

High · published July 21, 2026

CVSS v3.1
7.3
EPSS
1%
Percentile
52.0
In the wild
Unconfirmed
What it is

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0.

A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure.

Users are recommended to upgrade to version 1.4.0, which fixes the issue.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00684 · 52.0th percentile
Weakness
CWE-416 · Use After Free
Published
2026-07-21T10:54Z
EPSS history
Timeline
  • 21 JUL 10:54Z
    Apache Fory: Rust MetaString heap use-after-free
    cvelistv5