CVE-2026-60080 in Fory
Summary
by MITRE • 07/21/2026
Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0.
A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability under discussion represents a use after free condition within Apache Fory's rust deserialization implementation, specifically impacting versions ranging from 0.13.0 through 1.3.0. This type of memory safety issue occurs when a program continues to reference memory locations that have already been freed or deallocated, creating opportunities for exploitation that fall under the CWE-416 category of Use After Free. The flaw manifests during the deserialization process where maliciously crafted payloads can trigger improper memory management operations.
The technical execution of this vulnerability involves the manipulation of serialized data structures that Apache Fory processes using its rust-based deserialization logic. When the system encounters a specially crafted payload, it attempts to access memory regions that have already been released back to the system heap. This undefined behavior can result in program termination through crashes or potentially allow for information disclosure attacks where adjacent memory contents become accessible to unauthorized parties. The vulnerability directly impacts the memory safety guarantees provided by the rust programming language's ownership model during deserialization operations.
From an operational perspective, this vulnerability presents significant risks to systems relying on Apache Fory for data processing and serialization tasks. Attackers could potentially exploit this condition to cause denial of service through process crashes or to extract sensitive information from memory spaces that should remain protected. The impact extends beyond simple system availability concerns as the potential for memory disclosure means that confidential data, cryptographic keys, or other sensitive information stored in adjacent memory regions could be exposed to attackers. This vulnerability aligns with ATT&CK technique T1059.007 for execution through deserialization attacks and represents a critical memory corruption vulnerability.
The recommended remediation approach involves upgrading to Apache Fory version 1.4.0, which contains the necessary patches to address the use after free condition in the rust deserialization logic. This upgrade ensures that proper memory management practices are maintained throughout the deserialization process, preventing access to freed memory regions and eliminating the undefined behavior that enables exploitation. Organizations should prioritize this update as part of their vulnerability management protocols, particularly given the potential for both availability and confidentiality impacts. The fix likely implements proper reference counting or smart pointer mechanisms within the rust codebase to ensure that memory locations remain valid during active usage and are only deallocated when no longer referenced by any component of the deserialization pipeline.