CVE-2026-71558 Overview
CVE-2026-71558 is a heap type confusion vulnerability in Apache Fory C++ deserialization that affects versions from 0.14.0 before 1.5.0. A crafted input payload bypasses type compatibility checks during polymorphic smart-pointer deserialization. This causes an object of an incompatible type to be treated as the declared base type, producing undefined behavior in the heap.
The flaw maps to [CWE-843] (Access of Resource Using Incompatible Type) and [CWE-502] (Deserialization of Untrusted Data). Apache Fory 1.5.0 fixes the issue. Applications that do not use polymorphic smart-pointer deserialization in the C++ binding are not affected.
Critical Impact
Remote attackers can trigger memory corruption through crafted serialized payloads, leading to denial of service or arbitrary code execution without authentication or user interaction.
Affected Products
- Apache Fory C++ 0.14.0 through versions prior to 1.5.0
- Applications embedding Apache Fory C++ polymorphic smart-pointer deserialization
- Downstream services that accept untrusted Fory-encoded payloads over the network
Discovery Timeline
- 2026-08-07 - CVE-2026-71558 published to NVD
- 2026-08-08 - Last updated in NVD database
Technical Details for CVE-2026-71558
Vulnerability Analysis
Apache Fory is a multi-language serialization framework used for high-performance data exchange. The C++ implementation supports polymorphic deserialization of objects held by smart pointers such as std::shared_ptr and std::unique_ptr. During deserialization, the runtime must confirm that the concrete type encoded in the payload is compatible with the declared base type at the call site.
The vulnerable code path performs an incomplete type compatibility check. An attacker who controls the serialized byte stream can supply a type identifier for a class that is not a valid subtype of the expected base. The deserializer accepts the payload and constructs a heap object of the attacker-chosen type while returning a pointer typed as the declared base class.
Subsequent virtual method dispatch, member field access, or destructor invocation operates on memory laid out for a different class. This mismatch corrupts heap state and can be steered to redirect control flow.
Root Cause
The root cause is missing type-hierarchy validation in the polymorphic smart-pointer deserialization routine. The framework trusts the class identifier embedded in the serialized data instead of verifying that the resolved class is derived from the expected base. This is a classic type confusion pattern combined with unsafe deserialization of untrusted input.
Attack Vector
Exploitation requires the target application to deserialize attacker-controlled Fory payloads through the vulnerable C++ API. Any network-facing service that accepts Fory-encoded messages, such as an RPC endpoint, message queue consumer, or cache loader, exposes the attack surface. The attacker sends a payload declaring a mismatched concrete type and triggers the resulting undefined behavior when the receiving code accesses the object.
A verified proof-of-concept for CVE-2026-71558 is not publicly available. Technical details are described in the Apache Fory security advisory and the OpenWall oss-security discussion.
Detection Methods for CVE-2026-71558
Indicators of Compromise
- Crashes or SIGSEGV signals in processes linking Apache Fory C++ shared libraries between versions 0.14.0 and 1.5.0
- Unexpected heap corruption reports from AddressSanitizer or heap allocator diagnostics in services using Fory deserialization
- Anomalous large or malformed Fory payloads received on RPC or message-broker interfaces
Detection Strategies
- Inventory build artifacts and container images for libfory or Fory C++ headers between 0.14.0 and 1.5.0
- Enable AddressSanitizer or Undefined Behavior Sanitizer during pre-production testing to surface type confusion at the point of dispatch
- Correlate service crashes with inbound network events that carry Fory-encoded data using centralized log analytics
Monitoring Recommendations
- Alert on repeated process restarts of services that expose Fory deserialization endpoints
- Capture and retain packet or message-broker samples that precede unexpected worker termination for offline forensic replay
- Track outbound connections from Fory-using processes to detect post-exploitation command-and-control activity
How to Mitigate CVE-2026-71558
Immediate Actions Required
- Upgrade all Apache Fory C++ dependencies to version 1.5.0 or later and rebuild dependent binaries
- Audit application code for use of polymorphic smart-pointer deserialization APIs and restrict callers to trusted producers until patched
- Place network filtering in front of services that consume Fory payloads to reject traffic from untrusted sources
Patch Information
Apache Fory 1.5.0 corrects the type compatibility check in the polymorphic smart-pointer deserialization path. Consult the Apache mailing list announcement for the official fix reference and upgrade guidance.
Workarounds
- Disable or bypass polymorphic smart-pointer deserialization in the C++ binding if the application does not require it
- Restrict Fory endpoints to mutually authenticated peers using TLS client certificates or signed message envelopes
- Validate a strict allowlist of expected concrete class identifiers at the application layer before invoking Fory deserialization
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
