VYPR
← All advisories
Critical severity9.1NVD Advisory· Published Aug 7, 2026· Updated Aug 8, 2026

CVE-2026-71560

CVE-2026-71560

Description

Out-of-bounds Read vulnerability in Apache Fory C++ deserialization.

This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service.

Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications that do not use Apache Fory C++ or do not use tagged integer fields are not affected.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Apache/Fory2 versions
    cpe:2.3:a:apache:fory:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:apache:fory:*:*:*:*:*:*:*:*range: >=0.14.0,<1.5.0
    • (no CPE)range: <1.5.0
  • Apache/Fory C++llm-fuzzy
    Range: <1.5.0

Patches

Vulnerability mechanics

References

2

News mentions

1