Description

Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service. Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications that do not use Apache Fory C++ or do not use tagged integer fields are not affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-07T10:16:59.590Z",
  "pubdate": "2026-08-07T10:16:59.590Z",
  "executiveSummary": "An out-of-bounds read vulnerability exists in the Apache Fory C++ deserialization component, specifically impacting versions ranging from 0.14.0 prior to 1.5.0. The vulnerability is triggered when the affected software processes a maliciously crafted input payload containing specific structures with tagged integer fields. Successful exploitation of this flaw can lead to information disclosure or a denial of service condition against the host application. The risk implications are moderate to high depending on the sensitivity of the data resident in adjacent heap memory regions. Attackers must possess the capability to supply crafted input payloads directly to the vulnerable deserialization routines. Applications that do not incorporate Apache Fory C++ or entirely avoid the usage of tagged integer fields remain unaffected by this security flaw. Users and system administrators are strongly advised to implement available vendor patches to completely neutralize the underlying vector.",
  "technicalDetails": "The vulnerability resides within the tagged integer fast-path deserializer component of the Apache Fory C++ library. The root cause stems from improper bounds checking and validation of input length parameters when parsing serialized data streams containing tagged integer fields. During the execution of the fast-path deserialization logic, a crafted input payload can manipulate internal length or offset indicators, causing the parsing routine to read memory beyond the boundaries of the allocated heap buffer. The attack flow begins when an untrusted or maliciously crafted payload is processed by the Apache Fory C++ deserialization interface. As the parser iterates over the serialized structures, the tainted tagged integer fields direct the read pointer outside the intended memory region allocated for the input data. This triggers an out-of-bounds heap read operation. The affected versions include Apache Fory C++ from 0.14.0 up to, but not including, 1.5.0. Authentication and privilege requirements are dictated by the application context exposing the deserialization functionality, as the flaw itself exists within the data parsing logic rather than an explicit access control layer. Network exposure depends entirely on how the underlying application exposes the deserialization routines to external or untrusted data sources. The payload behavior involves inducing invalid pointer arithmetic or out-of-bounds memory referencing during heap-based data extraction. The post-exploitation impact includes unauthorized disclosure of sensitive heap memory contents, potentially leaking cryptographic keys, session tokens, or internal application states, as well as application crashes resulting in a denial of service due to segmentation faults or memory access violations."
}