CVE-2026-71558: Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization
Heap type confusion vulnerability in Apache Fory C++ deserialization.
This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution.
Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications not using Apache Fory C++ polymorphic smart-pointer deserialization are not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Fory C++to a version that resolves this vulnerability.Fixed in 1.5.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71558?
CVE-2026-71558 has a risk score of 72, indicating a high severity level.
How do I fix CVE-2026-71558?
To fix CVE-2026-71558, update Apache Fory C++ to version 1.5.0 or later.
Which versions of Apache Fory C++ are affected by CVE-2026-71558?
CVE-2026-71558 affects Apache Fory C++ versions from 0.14.0 before 1.5.0.
What type of vulnerability is CVE-2026-71558?
CVE-2026-71558 is a heap type confusion vulnerability related to polymorphic smart-pointer deserialization.
What impact does CVE-2026-71558 have on applications using Apache Fory?
CVE-2026-71558 could allow an attacker to bypass type compatibility checks, potentially leading to undefined behavior or exploitation.