External risk intelligence

Apache Fory C++ Deserialization Type Confusion Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-64608

The vulnerability exists in a deserialization component of a software library (Apache Fory). While such libraries are often used in network-facing applications, they are also frequently employed in internal data processing, batch jobs, and backend services. Exposure depends entirely on whether the specific application using the library accepts and deserializes untrusted data from the internet.

Deserialization

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security flaw has been identified in the C++ implementation of Apache Fory, a data serialization library. This vulnerability could allow attackers to manipulate data in a way that leads to memory corruption, potentially impacting the confidentiality, integrity, and availability of systems using this specific software component. The main concern is confirming if your environment utilizes this particular C++ library.

Data handling flaw in Apache Fory C++.
Affects systems processing deserialized data.
Confirm exposure and update if applicable.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted data to a system using the Apache Fory C++ implementation. Because the library does not properly validate data types during deserialization in compatible mode, an attacker can confuse the data type, leading to memory corruption. This could allow an attacker to take control of the affected system.

Attacker sends malformed data.
Data deserialization in compatible mode.
System crashes or is compromised.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the Apache Fory C++ implementation when it deserializes data in a compatible mode. If an input with an inconsistent schema is processed, it could lead to type confusion and out-of-bounds memory access, potentially impacting the integrity and availability of the service.

System data integrity and availability.
Processing inconsistent schema data.
Service disruption or data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Apache Fory C++ implementation requires immediate attention from teams responsible for applications utilizing this library. Ownership likely falls to the application development or platform teams, with support from infrastructure and security teams for exposure analysis and remediation planning. The first practical step is to inventory all instances of Apache Fory C++ within your environment, assess their reachability and business criticality, and then confirm the accountable owner for each instance to plan appropriate action.

Application owners should manage remediation efforts.
Verify all network-reachable instances first.
Plan upgrades during the next maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache Fory and what does the C++ implementation do?

Apache Fory is a library designed for data serialization, which is the process of converting complex data structures into a format suitable for storage or transmission. Developers use the C++ implementation to facilitate high-performance data handling within their software. Because it is a library, it typically serves as a modular component integrated into larger applications to manage how data is packaged and read across different parts of a system or between services.

How does type confusion impact systems in CVE-2026-64608?

This vulnerability involves a weakness known as type confusion (CWE-843), alongside out-of-bounds memory access (CWE-787). When the library deserializes data in its 'compatible mode,' it fails to verify that the incoming data matches the expected schema. This mismatch tricks the software into treating data incorrectly, which can cause memory corruption. This flaw effectively breaks the trust boundary between the incoming data and the application's internal memory management.

Do I need to be concerned if my application does not use compatible mode?

The vulnerability is specifically triggered during the deserialization of data when operating in compatible mode. If your application exclusively uses other modes or configurations that do not invoke this specific field-skipping path for deserialization, the trigger condition is not present. Furthermore, the issue is strictly limited to the C++ version of Apache Fory; implementations in other programming languages are not affected by this specific memory safety flaw.

Is my system at risk if it uses Apache Fory internally?

According to Halo Surface Signal, risk depends on whether your application accepts untrusted data. While Apache Fory is often used in internet-facing services, it is also common in internal backend processing and batch jobs. Even internal services are at risk if they process data from sources that an attacker might influence. You should prioritize assessing any instance of the library that ingests external or untrusted data, regardless of its network location.

How should I respond to this vulnerability?

Your first step is to perform an inventory to identify every instance of the Apache Fory C++ library within your software ecosystem. Once located, verify which applications use the affected versions (0.14.0 through 1.3.x). Coordinate with application owners to plan an upgrade to version 1.4.0, which resolves the validation issue. Focus your initial efforts on components that are reachable from the network or that process data from outside your trusted environment.

References

lists.apache.org/thread/wl05slf57zzoq1s4pg4tk6nx6mjyjr4b

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.