CVE-2026-64608 in Fory
Summary
by MITRE • 07/21/2026
Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and out-of-bounds memory access. Only the C++ implementation is affected; other language implementations of Apache Fory are not.
This issue affects Apache Fory C++: from 0.14.0 before 1.4.0.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability described represents a critical heap-based type confusion and out-of-bounds memory access flaw in the Apache Fory C++ implementation that stems from inadequate validation during data deserialization processes. This weakness specifically manifests when the library operates in compatible mode, where it attempts to deserialize data streams that may contain schema inconsistencies between declared field types and actual data payloads. The root cause lies in the field-skip paths within the deserialization logic that fail to properly validate type declarations against incoming data structures, creating opportunities for attackers to manipulate memory layouts through crafted input sequences.
The technical execution of this vulnerability involves exploiting the mismatch between expected and actual data types during deserialization operations. When Apache Fory encounters inconsistent schema information, particularly in compatible mode where backward compatibility is maintained, the C++ implementation's validation mechanisms become insufficient. This allows malicious actors to construct serialized data containing fields with declared types that differ from their actual content, leading to type confusion scenarios where memory is accessed using incorrect assumptions about data layout and size.
This vulnerability carries significant operational impact as it can result in arbitrary code execution or system crashes when exploited. The out-of-bounds read/write capabilities provide attackers with potential paths to information disclosure, denial of service conditions, or privilege escalation depending on the execution environment. The issue affects all versions from 0.14.0 through 1.3.9 of the C++ implementation, making it a substantial risk for organizations relying on this library for data serialization and deserialization tasks in their applications.
The flaw aligns with CWE-122 heap-based buffer overflow and CWE-476 null pointer dereference categories, representing a classic case of improper input validation leading to memory corruption vulnerabilities. From an attack perspective, this vulnerability maps to ATT&CK technique T1059.007 for command and scripting interpreter execution and T1203 legitimate credentials use through potential privilege escalation paths that may arise from successful exploitation. The vulnerability's scope is limited to the C++ implementation of Apache Fory, which means developers working with other language bindings such as Java, Python, or JavaScript are not affected by this particular flaw.
Organizations utilizing Apache Fory in their applications should prioritize immediate upgrade to version 1.4.0 or later, which includes comprehensive fixes addressing both the type confusion and out-of-bounds access issues. The remediation process requires careful testing of existing codebases to ensure compatibility with the patched implementation while verifying that all deserialization paths properly handle schema variations. Security teams should also implement monitoring for suspicious deserialization patterns in their environments and consider additional input validation layers as defensive measures against similar vulnerabilities in other components of their software stack.