Apache Fory C++ Deserialization Flaw Could Enable Remote Code Execution
Vulnerability Disclosure · 5 sources · Updated 3mo ago · First seen Aug 7, 2026
Apache disclosed CVE-2026-71558, a heap type confusion flaw in Apache Fory's C++ deserialization logic that affects versions 0.14.0 through versions before 1.5.0. The vulnerability is triggered by a crafted input payload during polymorphic smart-pointer deserialization, allowing type compatibility checks to be bypassed so an incompatible object can be treated as the declared base type. Apache and downstream advisories warn that successful exploitation can cause undefined behavior and may lead to denial of service or arbitrary code execution.
The issue is tracked as CWE-502 and carries a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a network-exploitable flaw with high impact across confidentiality, integrity, and availability. Apache said applications that do not use Fory C++ polymorphic smart-pointer deserialization are not affected, and recommended upgrading to Apache Fory 1.5.0, which fixes the bug. The vulnerability was reported by independent security researcher Zhixi "Jace" Sun, while CISA SSVC metadata listed exploitation as none observed, automatable as yes, and technical impact as total.
