CVE-2026-48207 is a critical vulnerability in Apache Fory's PyFory component affecting versions before 1.0.0. The ReduceSerializer can bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution if Python-native mode is used with strict mode disabled. This allows unsafe classes, functions, or module attributes to be deserialized from untrusted data, potentially leading to remote code execution or other severe impacts. The vulnerability is fixed in Apache Fory 1.0.0, which enforces proper DeserializationPolicy validation for the affected ReduceSerializer paths.

Successful exploitation can lead to full compromise of the affected application due to deserialization of untrusted data, allowing attackers to execute arbitrary code, modify data, or cause denial of service. The CVSS score of 9.8 reflects high attack vector accessibility (network), low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Users should upgrade Apache Fory to version 1.0.0 or later, where the vulnerability is fixed by enforcing DeserializationPolicy validation in the ReduceSerializer. No other mitigations are specified. Patch status is confirmed by the vendor advisory stating the fix in version 1.0.0.