CVE-2026-64608 Overview
CVE-2026-64608 is a heap type confusion and out-of-bounds read/write vulnerability in the Apache Fory C++ implementation. When Apache Fory deserializes data in compatible mode, the field-skip paths fail to validate declared field types against the actual data on the wire. An attacker who supplies input with an inconsistent schema can trigger type confusion and out-of-bounds memory access on the heap. The flaw is tracked as an insecure deserialization issue [CWE-502]. Only the C++ implementation is affected. Other Apache Fory language bindings, such as Java, Python, Go, and Rust, are not impacted by this issue.
Critical Impact
Remote attackers can send crafted serialized payloads to processes using Apache Fory C++ in compatible mode, leading to memory corruption and potential remote code execution without authentication or user interaction.
Affected Products
- Apache Fory C++ from 0.14.0 up to but not including 1.4.0
- Applications embedding Apache Fory C++ for cross-language serialization
- Services deserializing untrusted Fory payloads in compatible mode
Discovery Timeline
- 2026-07-21 - CVE-2026-64608 published to NVD
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2026-64608
Vulnerability Analysis
Apache Fory is a multi-language serialization framework designed for high-performance data exchange. The C++ implementation supports a compatible mode intended to tolerate schema evolution between producers and consumers. During deserialization, the runtime encounters fields whose declared type may not match what the payload contains and dispatches to field-skip paths to advance the read cursor.
The vulnerability stems from these skip paths trusting the declared field type without cross-checking the actual on-wire representation. An attacker who controls the serialized bytes can declare one type while embedding data of a different, inconsistent type. The deserializer then interprets memory according to the declared type, producing a type confusion condition. Depending on the mismatched types, the resulting reads or writes fall outside the intended object bounds on the heap.
Because Apache Fory is commonly used in server-side data pipelines and RPC layers, network-reachable deserialization endpoints expose the flaw directly to remote attackers.
Root Cause
The field-skip logic in the C++ deserializer lacks a validation step that compares the declared field type against the actual encoded type. This missing check enables heap type confusion and adjacent out-of-bounds read and write operations classified under [CWE-502] Deserialization of Untrusted Data.
Attack Vector
Exploitation requires an attacker to deliver a crafted Fory-serialized payload to a target application deserializing input in compatible mode. No authentication or user interaction is required. Because the attack traverses the network and reaches the deserializer directly, any service exposing a Fory endpoint over the network is reachable. Successful exploitation can produce memory disclosure, memory corruption, denial of service, or arbitrary code execution in the process context of the vulnerable application.
No public proof-of-concept exploit code has been published at the time of writing. Refer to the Apache Mailing List Discussion and the OpenWall OSS Security Update for the vendor's technical description.
Detection Methods for CVE-2026-64608
Indicators of Compromise
- Unexpected crashes, segmentation faults, or heap corruption reports in processes linking Apache Fory C++ between 0.14.0 and 1.4.0.
- Anomalous inbound traffic to Fory deserialization endpoints containing malformed schema metadata or unusually large field-skip sequences.
- Child processes or outbound network connections spawned by services that normally only deserialize data.
Detection Strategies
- Inventory build manifests, container images, and dependency lock files for Apache Fory C++ versions in the vulnerable range.
- Deploy application-layer inspection on RPC and message-bus channels that transport Fory payloads to flag inconsistent schema declarations.
- Enable AddressSanitizer or heap-guard instrumentation in non-production environments to surface out-of-bounds accesses during fuzz testing.
Monitoring Recommendations
- Alert on abnormal termination of services that consume Fory data, correlating crash dumps with recent inbound payloads.
- Log deserialization errors with payload metadata to support forensic reconstruction after suspected exploitation attempts.
- Track process behavior on hosts running Fory consumers for signs of code execution, such as unexpected shell invocations or file writes.
How to Mitigate CVE-2026-64608
Immediate Actions Required
- Upgrade Apache Fory C++ to version 1.4.0 or later across all affected services and dependent libraries.
- Rebuild and redeploy any container images, packaged binaries, or static libraries that embed a vulnerable Fory version.
- Restrict network exposure of services that deserialize Fory payloads until patching is complete.
Patch Information
The Apache Fory project fixed this vulnerability in version 1.4.0. Users of any release in the range 0.14.0 through 1.3.x of the C++ implementation must upgrade. Consult the Apache Mailing List Discussion for the official advisory and upgrade guidance.
Workarounds
- Where upgrading is not immediately feasible, avoid using compatible mode when deserializing untrusted input.
- Terminate Fory deserialization behind an authenticated, mutually authenticated transport to reduce untrusted exposure.
- Apply strict schema validation and payload size limits at the application boundary before invoking the Fory deserializer.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
