CVE-2026-71558

A heap type confusion vulnerability in Apache Fory C++ deserialization affects versions 0.14.0 up to (before) 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declar...