CVE-2026-71558: apache software foundation apache fory Deserialization of Untrusted Data

Vulnerability summary

CVE-2026-71558 is a critical (CVSS 9.8) Deserialization of Untrusted Data vulnerability in apache software foundation apache fory. EPSS estimates a 0.99% chance of exploitation in the next 30 days, higher than 61.8% of scored vulnerabilities.

Timeline

1. 07-08-2026
   PublishedVulnerability first disclosed.
2. 07-08-2026
   Last modifiedVulnerability information updated.

Description

Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution. Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications not using Apache Fory C++ polymorphic smart-pointer deserialization are not affected.

• CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
• CWE-843Access of Resource Using Incompatible Type ('Type Confusion')The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.