CVE-2026-64609 Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization

Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected. This iss...

CVE-2026-64609

CVE-2026-64609 affects Apache Fory (formerly Apache Fury). The issue is an out-of-bounds read via sun.misc.Unsafe when using the opt-in out-of-band zero-copy deserialization; readAlignedVarUint() may read beyond the underlying buffer. Affected range is 0.5.0 up to 1.3.x, with 1.4.0+ fixed. Versio...