Non notée
CVE-2026-71558 Heap type confusion vulnerability in Apache Fory C++ deserialization
Description
Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution. Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications not using Apache Fory C++ polymorphic smart-pointer deserialization are not affected.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Fory 0.14 | 0.14.0 → < 1.5.0 | 1.5.0 |
Références
- lists.apache.org lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Fory
Les 11 CVE de Apache Fory →
CVE-2026-71559
Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a…
Non notée
CVE-2026-71560
Out-of-bounds Read vulnerability in Apache Fory C++ deserialization
Non notée
CVE-2026-60080
Use After Free vulnerability in the Rust deserialization logic of Apache Fory
Non notée
CVE-2026-64606
Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java…
Non notée