CVE-2026-64608 Details
Description
Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and out-of-bounds memory access. Only the C++ implementation is affected; other language implementations of Apache Fory are not. This issue affects Apache Fory C++: from 0.14.0 before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue.
A heap type confusion vulnerability leading to out-of-bounds read and write operations has been identified in the Apache Fory C++ implementation, affecting versions 0.14.0 prior to 1.4.0. The issue arises when deserializing data in compatible mode, where the field-skip paths fail to properly validate the declared field types against the actual data. This mismatch allows for type confusion and out-of-bounds memory access. Notably, other language implementations of Apache Fory are not affected.
Users are advised to upgrade to Apache Fory version 1.4.0 or later, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/07/21/5 | CVE | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/wl05slf57zzoq1s4pg4tk6nx6mjyjr4b | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
| CWE-787 | Out-of-bounds Write | [email protected] |
| CWE-843 | Access of Resource Using Incompatible Type ('Type Confusion') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache fory | >= 0.14.0, < 1.4.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 11, 2026 | Initial Analysis | [email protected] |
| Jul 21, 2026 | CVE Modified | CVE |
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | [email protected] |