CVE-2026-71560: Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing…

PriorityP350critical9.1CVSS 3.1

AVNACLPRNUINSUCNIHAH

EPSS

0.77%

55.1th percentile

Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service. Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications that do not use Apache Fory C++ or do not use tagged integer fields are not affected.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	fory	>= 0.14.0 < 1.5.0	1.5.0
apache_software_foundation	apache_fory	>= 0.14.0 < 1.5.0	1.5.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.