CVE-2026-71560 in Fory
Summary
by MITRE • 08/07/2026
Out-of-bounds Read vulnerability in Apache Fory C++ deserialization.
This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service.
Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications that do not use Apache Fory C++ or do not use tagged integer fields are not affected.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability under discussion represents a critical out-of-bounds read condition within the Apache Fory C++ deserialization framework, specifically impacting versions ranging from 0.14.0 through 1.4.9. This flaw resides in the handling of tagged integer fields during the deserialization process, where the library fails to properly validate input boundaries before accessing memory locations. The vulnerability manifests when processing structured data containing tagged integers, creating a scenario where maliciously crafted payloads can cause the deserializer to read beyond allocated heap memory regions.
The technical implementation of this vulnerability stems from insufficient bounds checking within the fast-path deserializer for tagged integer types. When Apache Fory C++ encounters serialized data with tagged integers, it attempts to parse these values without adequate validation of array indices or buffer limits. This weakness allows an attacker to construct input payloads that manipulate the deserialization logic into accessing memory locations outside the intended data structure boundaries. The flaw operates at the memory access level where heap-based buffer over-reads occur, potentially exposing sensitive information stored in adjacent memory locations.
From an operational impact perspective, this vulnerability creates significant security implications including potential information disclosure and denial of service conditions. An attacker exploiting this out-of-bounds read could extract confidential data from adjacent memory segments, potentially including cryptographic keys, session tokens, or other sensitive application information. The vulnerability also enables denial of service attacks by causing application crashes or abnormal termination when the deserializer encounters malformed input that triggers heap access violations. This affects systems processing serialized data through Apache Fory C++ components and could compromise entire applications relying on this library for data exchange.
The vulnerability aligns with CWE-125, which describes out-of-bounds read conditions in software implementations, specifically targeting heap-based memory corruption scenarios. From an attack framework perspective, this issue maps to ATT&CK technique T1059.007 for deserialization attacks and T1499.004 for denial of service through resource exhaustion. The exploitation requires knowledge of the target system's memory layout and careful crafting of serialized input that manipulates the tagged integer parsing logic. Organizations should consider this vulnerability as part of their broader application security posture, particularly in systems processing untrusted data through C++ deserialization components.
Mitigation strategies center on upgrading to Apache Fory C++ version 1.5.0 or later, which includes proper bounds checking and memory validation for tagged integer fields. System administrators should also implement input validation measures at the application level, sanitizing all serialized data before processing through the deserialization framework. Additionally, organizations should consider deploying runtime protections such as address space layout randomization and stack canaries to limit the impact of potential exploitation attempts. Regular security assessments of applications using this library are recommended to identify and remediate similar vulnerabilities in other components that may be susceptible to similar out-of-bounds access patterns.
This vulnerability demonstrates the critical importance of proper memory management in serialization frameworks, where seemingly simple data type handling can create significant security risks. The issue highlights the need for comprehensive testing of deserialization logic against malformed inputs and underscores the necessity of implementing robust bounds checking mechanisms in all memory-accessing code paths. Organizations utilizing Apache Fory C++ should conduct immediate vulnerability assessments to identify systems running affected versions and implement appropriate remediation measures to prevent exploitation attempts targeting this specific out-of-bounds read condition.