CVE-2026-71558

CriticalCVSS 9.8/10Last modified Oct 24, 2026

Description

Heap type confusion vulnerability in Apache Fory C++ deserialization.

This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution.

Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications not using Apache Fory C++ polymorphic smart-pointer deserialization are not affected.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502 CWE-843

Affected software

No affected versions have been published.

Timeline

Published: Aug 7, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-715597.5Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by s CVE-2026-71569.8A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function CsteSystem of the file /cgi-bin/cstecgi.cgi o CVE-2026-715609.1Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 w CVE-2026-715626.3Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to CVE-2026-715634.3Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An authorization flaw in the MCP CVE-2026-715647.8Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of t CVE-2026-715655.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu CVE-2026-715669.3FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC CVE-2026-715677.7In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them eit CVE-2026-715685.3In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race CVE-2026-71577.3A flaw has been found in disler aider-mcp-server up to b2516fa466d0d851932da92ee6d0e66946db9efc. Affected by this vulnerability is an unknow CVE-2026-715705.1Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11 - A backend operator granted access scoped t