Description

Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution. Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications not using Apache Fory C++ polymorphic smart-pointer deserialization are not affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-07T10:16:59.337Z",
  "pubdate": "2026-08-07T10:16:59.337Z",
  "executiveSummary": "A heap type confusion vulnerability exists in the C++ deserialization component of Apache Fury versions ranging from 0.14.0 prior to 1.5.0. This security flaw arises during polymorphic smart-pointer deserialization, where insufficient type compatibility checks allow a maliciously crafted input payload to successfully bypass internal validation mechanisms. Consequently, an instantiated object of an inherently incompatible type is forcibly treated as the expected declared base type within the application memory space.\nThe primary impact of this vulnerability encompasses memory corruption leading to undefined program behavior, potential denial of service conditions, and the theoretical capability for arbitrary code execution depending on subsequent operations performed on the misidentified object. The attack vector requires an adversary with the ability to supply a specifically crafted serialized payload to an application utilizing vulnerable polymorphic smart-pointer deserialization routines. Applications that do not leverage this specific feature within Apache Fury C++ remain unaffected by this issue.\nGiven the severity associated with memory safety violations in compiled C++ environments, organizations utilizing vulnerable versions face significant integrity and availability risks. Remediation strictly requires upgrading the affected Apache Fury library installations to version 1.5.0 or later, where the underlying type compatibility checks during deserialization have been properly secured.",
  "technicalDetails": "The root cause of this vulnerability lies in inadequate type verification during the deserialization of polymorphic smart pointers within the Apache Fury C++ component. When processing serialized streams representing object hierarchies, the library must resolve concrete runtime types and verify their structural or hierarchical compatibility against the statically declared base types expected by the receiving application logic.\nDue to the flawed validation logic, a crafted input payload can inject malicious type metadata into the deserialization pipeline. When the Apache Fury C++ deserializer processes this payload, it fails to correctly enforce type constraints, allowing an object of an arbitrary or incompatible type to bypass safety checks and be instantiated and cast as the declared base type.\nThe attack flow proceeds as follows: First, an attacker constructs a malicious serialized payload containing manipulated type identifiers designed to deceive the polymorphic deserialization routine. Second, the attacker transmits this payload to a target application utilizing Apache Fury C++ for object reconstruction. Third, the vulnerable deserialization component parses the input, accepts the invalid type mapping without proper validation, and constructs an incompatible object assigned to a smart pointer of the base type. Fourth, when the application subsequently interacts with this smart pointer—invoking virtual methods or accessing member variables based on the assumed base type layout—type confusion occurs.\nThe vulnerable component is the Apache Fury C++ deserialization engine, specifically handling polymorphic smart-pointer mechanics across versions from 0.14.0 before 1.5.0. Exploitation does not inherently mandate authentication or high privileges if the application exposes an unauthenticated endpoint accepting serialized data. Network exposure depends entirely on the architecture of the host application consuming untrusted input streams. The post-exploitation impact includes memory corruption, unexpected application crashes resulting in denial of service, and potential control flow hijack scenarios leading to arbitrary code execution within the context of the running process."
}