Out-of-Bounds Read Vulnerability in Apache Fory C++ Software

CVE-2026-71560

What is CVE-2026-71560?

A serious out-of-bounds read vulnerability has been identified in Apache Fory C++, specifically affecting versions from 0.14.0 up to but not including 1.5.0. This vulnerability arises during the deserialization of structures containing tagged integer fields. An attacker could craft specific input payloads aimed at exploiting this flaw, potentially leading to information disclosure or even a denial of service. Upgrading to Apache Fory version 1.5.0 is recommended to mitigate this risk. Applications not utilizing Apache Fory C++ or tagged integer fields remain unaffected.

References