CVE-2026-64608

CVE-2026-64608: Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths

Vendor Apache Software Foundation

Product Apache Fory

Weakness CWE-843

Published July 21, 2026

Last update July 21, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and out-of-bounds memory access. Only the C++ implementation is affected; other language implementations of Apache Fory are not. This issue affects Apache Fory C++: from 0.14.0 before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Key dates

02Disclosure timeline

July 21, 2026 CVE published

July 21, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-64608 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/843.html AskarLabs — CWE-843 write-up Access of Resource Using Incompatible Type ('Type Confusion')

Related vulnerabilities

CVE-2026-64608: Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths

01Description

02Disclosure timeline

03References

04Related CVE