CVE-2026-64608
A flaw in Apache Fory's C++ library lets attackers corrupt memory when the library reads data that doesn't match its expected format. The bug can crash the program or let attackers run arbitrary code. It only affects the C++ version of the library.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Apache Fory C++ library, versions 0.14.0 up to but not including 1.4.0. Developers or applications that use this library for data serialization.
Real-world impact
An attacker could send specially crafted data to a program using the vulnerable library, causing it to crash or execute malicious code, potentially taking control of the system or leaking sensitive information.
Why this severity
The CVSS score is high because the flaw can be exploited remotely without authentication, requires no user interaction, and can compromise confidentiality, integrity, and availability of the affected system.
What to do about it
- 01Upgrade Apache Fory C++ to version 1.4.0 or later.
NVD-referenced vendor advisory
Timeline
- Jul 21, 2026 · 12d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 12d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.