Loading vulnerability…
Heap type confusion and out-of-bounds read/write in Apache Fory C++ deserialization
CVE-2026-64608 is a memory-safety vulnerability in the Apache Fory C++ implementation affecting versions 0.14.0 through before 1.4.0. The flaw occurs during deserialization in compatible mode, where field-skip code paths do not correctly validate declared field types against the actual serialized data. A crafted input containing an inconsistent schema can therefore trigger heap type confusion and subsequent out-of-bounds memory access, including both read and write conditions. The issue is limited to the C++ implementation of Apache Fory; other language implementations are not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause unsafe memory access during deserialization, leading to heap corruption, out-of-bounds reads, and out-of-bounds writes. Depending on application behavior and runtime conditions, this may result in process crashes, denial of service, data exposure from memory, data corruption, or potentially arbitrary code execution. Available scoring metadata indicates high impact to confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, reduce exposure by preventing untrusted or attacker-controlled serialized data from reaching Apache Fory C++ deserialization routines, especially where compatible mode is enabled. Enforce strict trust boundaries for serialized inputs, prefer schema validation before deserialization where feasible, and isolate or sandbox services that process untrusted serialized content until the fixed version can be deployed. These measures are compensating controls and do not replace upgrading.
Patch, then assume compromise.
Upgrade Apache Fory C++ to version 1.4.0 or later. Version 1.4.0 contains the fix for the incorrect type validation in compatible-mode deserialization field-skip paths.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.