EUVD-2026-54421

Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path...

CVE-2026-64608

Apache Fory: C++ implementation suffers a heap type confusion and out-of-bounds read/write during deserialization in compatible mode. Inconsistent schemas between declared field types and data can trigger memory access issues. Affected: Apache Fory C++ from 0.14.0 up to but not including 1.4.0. R...