{
  "from_raw": "Chaokun Yang <chaokunyang@apache.org>",
  "from": "Chaokun Yang <ch...@apache.org>",
  "gravatar": "5dac1def761b1a642c93c34593f74545",
  "to": "an...@apache.org,\n de...@fory.apache.org",
  "subject": "CVE-2026-64608: Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths",
  "message-id": "<e98ee64d-e6a6-1525-453d-6173d0908900@apache.org>",
  "mid": "wnm49y9ynmw7v5skllzy689tp6qds57f",
  "permalinks": [
    "wnm49y9ynmw7v5skllzy689tp6qds57f",
    "ra9e48a63cee6cf62e06fec7a8c62a9717e09aaa3bae9e167ea26c2dd@<announce.apache.org>"
  ],
  "dbid": "4e0be28d686b0a31676d62061318fef6c5f19f4e926e5e2f8565571e3b64f52c",
  "cc": "de...@fory.apache.org",
  "epoch": 1784625591,
  "list": "<announce.apache.org>",
  "list_raw": "<announce.apache.org>",
  "date": "2026/07/21 09:19:51",
  "private": false,
  "references": "",
  "in-reply-to": "",
  "body": "Severity: important \n\nAffected versions:\n\n- Apache Fory 0.14.0 before 1.4.0\n\nDescription:\n\nHeap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and out-of-bounds memory access. Only the C++ implementation is affected; other language implementations of Apache Fory are not.\n\nThis issue affects Apache Fory C++: from 0.14.0 before 1.4.0.\n\nUsers are recommended to upgrade to version 1.4.0, which fixes the issue.\n\nCredit:\n\nNguyen Van Hiep (@hypnguyen1209) from MBBank (reporter)\n\nReferences:\n\nhttps://fory.apache.org\nhttps://www.cve.org/CVERecord?id=CVE-2026-64608\n\n",
  "body_short": "Severity: important \n\nAffected versions:\n\n- Apache Fory 0.14.0 before 1.4.0\n\nDescription:\n\nHeap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing dat",
  "html_source_only": false,
  "attachments": [],
  "forum": "announce@apache.org",
  "size": 2787,
  "id": "wnm49y9ynmw7v5skllzy689tp6qds57f"
}