VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Jul 21, 2026· Updated Aug 11, 2026

CVE-2026-64608

CVE-2026-64608

Description

Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and out-of-bounds memory access. Only the C++ implementation is affected; other language implementations of Apache Fory are not.

This issue affects Apache Fory C++: from 0.14.0 before 1.4.0.

Users are recommended to upgrade to version 1.4.0, which fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Apache/Fory
    cpe:2.3:a:apache:fory:*:*:*:*:*:*:*:*
    Range: >=0.14.0,<1.4.0
  • Apache/Fory C++llm-create
    Range: from 0.14.0 before 1.4.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.