CVE-2026-71558CWE-502CWE-843insecure-deserialization

CVE-2026-71558

Critical · published August 7, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
62.2
In the wild
Unconfirmed
What it is

Heap type confusion vulnerability in Apache Fory C++ deserialization.

This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution.

Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications not using Apache Fory C++ polymorphic smart-pointer deserialization are not affected.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00990 · 62.2th percentile
Weaknesses
CWE-502 · Deserialization of Untrusted Data; CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion')
Published
2026-08-07T14:16Z
Affected products (1)
ProductVersionsFixed in
apache/fory≥ 0.14.0, < 1.5.01.5.0
References (2)
https://lists.apache.org/thread/oywndv60jwqdv6j37t7bc1qbcc4b235r · [email protected]http://www.openwall.com/lists/oss-security/2026/08/07/3 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 07 AUG 08:54Z
    Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization
    cvelistv5