open-source-dependency-vulnerabilitywidely-deployed-product-advisory

Critical Deserialization Flaw in Apache Fory C++ Enables Memory Corruption

Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Jul 21, 2026

Apache disclosed CVE-2026-64608, a critical vulnerability in the Apache Fory C++ implementation that can cause heap type confusion and out-of-bounds read/write during deserialization. The flaw occurs in compatible mode when field-skip paths do not properly validate declared field types against the actual data being processed, creating a memory-corruption condition that could have severe impact on affected deployments.

The issue affects Apache Fory C++ versions 0.14.0 through before 1.4.0 and does not affect other Apache Fory language implementations. Apache has advised users to upgrade to 1.4.0 to remediate the bug. The vulnerability was reported by Nguyen Van Hiep (@hypnguyen1209) of MBBank, and CISA SSVC metadata indicates no known exploitation so far, while noting the issue may be automatable and carries total technical impact.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Jul 21, 2026

Jul 21, 20264mo ago
CVE record updated with CVSS and CISA SSVC metadata
The CVE-2026-64608 record was updated on 2026-07-21 with a CVSS v3.1 vector indicating critical impact and CISA SSVC metadata. The metadata noted no known exploitation, automatable exploitation potential, and total technical impact.
CVE-2026-64608 - Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths
Jul 21, 20264mo ago
Apache recommends upgrading Apache Fory C++ to 1.4.0
Apache recommended upgrading affected Apache Fory C++ deployments to version 1.4.0 to remediate CVE-2026-64608. The fix guidance accompanied the public disclosure of the vulnerability.
CVE-2026-64608 - Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths
Jul 21, 20264mo ago
Apache Fory discloses CVE-2026-64608 in C++ implementation
A security advisory disclosed CVE-2026-64608, a heap type confusion flaw that can lead to out-of-bounds read and write during deserialization in Apache Fory C++ compatible mode. The advisory states that versions 0.14.0 before 1.4.0 are affected and that other language implementations are not impacted.
CVE-2026-64608 - Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Heap type confusion and out-of-bounds read/write in Apache Fory C++ deserialization (CVE-2026-64608)

Organizations

1 linked

Apache Software Foundation

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Cvefeed High SeverityAdvisories · Jul 21, 2026

CVE-2026-64608 - Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip pathsOpen source ↗

Oss Security Mailing ListNews · Jul 21, 2026

oss-sec: CVE-2026-64608: Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip pathsOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

open-source-dependency-vulnerabilitywidely-deployed-product-advisory

Critical Deserialization Flaw in Apache Fory C++ Enables Memory Corruption

Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Jul 21, 2026

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Jul 21, 2026

Jul 21, 20264mo ago
CVE record updated with CVSS and CISA SSVC metadata
The CVE-2026-64608 record was updated on 2026-07-21 with a CVSS v3.1 vector indicating critical impact and CISA SSVC metadata. The metadata noted no known exploitation, automatable exploitation potential, and total technical impact.
CVE-2026-64608 - Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths
Jul 21, 20264mo ago
Apache recommends upgrading Apache Fory C++ to 1.4.0
Apache recommended upgrading affected Apache Fory C++ deployments to version 1.4.0 to remediate CVE-2026-64608. The fix guidance accompanied the public disclosure of the vulnerability.
CVE-2026-64608 - Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths
Jul 21, 20264mo ago
Apache Fory discloses CVE-2026-64608 in C++ implementation
A security advisory disclosed CVE-2026-64608, a heap type confusion flaw that can lead to out-of-bounds read and write during deserialization in Apache Fory C++ compatible mode. The advisory states that versions 0.14.0 before 1.4.0 are affected and that other language implementations are not impacted.
CVE-2026-64608 - Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Heap type confusion and out-of-bounds read/write in Apache Fory C++ deserialization (CVE-2026-64608)

Organizations

1 linked

Apache Software Foundation

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Cvefeed High SeverityAdvisories · Jul 21, 2026

CVE-2026-64608 - Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip pathsOpen source ↗

Oss Security Mailing ListNews · Jul 21, 2026

oss-sec: CVE-2026-64608: Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip pathsOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Critical Deserialization Flaw in Apache Fory C++ Enables Memory Corruption

How this story unfolded

CVE record updated with CVSS and CISA SSVC metadata

Apache recommends upgrading Apache Fory C++ to 1.4.0

Apache Fory discloses CVE-2026-64608 in C++ implementation

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Apache Fory C++ Deserialization Flaw Could Enable Remote Code Execution

Critical Apache Fory Deserialization Flaw Bypasses Class Registration Checks

Apache Fory Out-of-Bounds Read Flaw Affects Zero-Copy Java Deserialization

Critical Deserialization Flaw in Apache Fory C++ Enables Memory Corruption

How this story unfolded

CVE record updated with CVSS and CISA SSVC metadata

Apache recommends upgrading Apache Fory C++ to 1.4.0

Apache Fory discloses CVE-2026-64608 in C++ implementation

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Apache Fory C++ Deserialization Flaw Could Enable Remote Code Execution

Critical Apache Fory Deserialization Flaw Bypasses Class Registration Checks

Apache Fory Out-of-Bounds Read Flaw Affects Zero-Copy Java Deserialization