CVE-2026-64608

Katalog CVE

CVSS 9.8 · Critical EPSS 0,81%

Kerentanan Deserialization of Untrusted Data pada apache fory. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP.

Deskripsi (NVD)

Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and out-of-bounds memory access. Only the C++ implementation is affected; other language implementations of Apache Fory are not. This issue affects Apache Fory C++: from 0.14.0 before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Rincian

Terbit di NVD

21 Juli 2026

Terakhir diubah

11 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data
CWE-787: Out-of-bounds Write
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

EPSS (30 hari)

0,81% peluang dieksploitasi; lebih tinggi dari 55,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/wl05slf57zzoq1s4pg4tk6nx6mjyjr4b mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/07/21/5 mailing list · advisory pihak ketiga