Paper/Archive/CVE-2026-71558

CVE-2026-71558

Apache Software Foundation Apache Fory — Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization

EPSS 1.0%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 62.5.625 × 2012.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution. Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications not using Apache Fory C++ polymorphic smart-pointer deserialization are not affected.

Affected

ProductAffectedFixed inSource

Apache Fory0.14.0 – < 1.5.01.5.0CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorylists.apache.org/thread/oywndv60jwqdv6j37t7bc1qbcc4b235r refopenwall.com/lists/oss-security/2026/08/07/3