Loading vulnerability…
Heap Type Confusion in Apache Fory C++ Polymorphic Smart-Pointer Deserialization
CVE-2026-71558 is a heap type confusion vulnerability in Apache Fory C++ deserialization affecting versions from 0.14.0 before 1.5.0. The flaw occurs during polymorphic smart-pointer deserialization, where a crafted input payload can bypass type compatibility checks and cause an object of an incompatible type to be treated as the declared base type. This unsafe type handling can trigger undefined behavior in heap-resident objects and may be exploitable for denial of service or arbitrary code execution. Applications that do not use Apache Fory C++ polymorphic smart-pointer deserialization are not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause undefined behavior in the target process, including process crashes and denial of service. Because the flaw allows incompatible object types to be interpreted as expected base types during deserialization, memory corruption conditions may arise that could potentially be leveraged for arbitrary code execution. Available scoring and descriptions indicate the issue is remotely exploitable without authentication when a vulnerable application accepts attacker-controlled serialized input.
If you can’t patch tonight, do this now.
If immediate upgrading is not possible, avoid or disable the affected Apache Fory C++ polymorphic smart-pointer deserialization path wherever feasible. Do not deserialize untrusted or attacker-controlled data with vulnerable versions. Reduce exposure by restricting remote inputs that reach deserialization logic until the fixed release can be deployed.
Patch, then assume compromise.
Upgrade Apache Fory C++ to version 1.5.0 or later. Version 1.5.0 contains the fix for the type compatibility bypass in polymorphic smart-pointer deserialization.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.