CVE-2026-71558

Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution. Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications not using Apache Fory C++ polymorphic smart-pointer deserialization are not affected.

Published 07 Aug 2026, 10:16 UTC Last modified 07 Aug 2026, 10:16 UTC

Attack profile

The conditions required to exploit this vulnerability and its potential impact.

Attack vector Not assessed

Attack complexity Not assessed

Privileges required Not assessed

User interaction Not assessed

Scope Not assessed

Confidentiality Not assessed

Integrity Not assessed

Availability Not assessed

Affected products

Product applicability statements supplied with the NVD record.

NVD has not published structured affected-product data for this record.

Weakness classification

CWE categories help security teams group the underlying software weakness.

CWECWE-502

Source references

External advisories, patches and technical reports attached to this CVE record.

NVD National Vulnerability Database recordnvd.nist.gov 01 Technical reference security@apache.org