Threats tagged 'ghsa-rwv5-p9fv-c8fp'

CVE-2026-71558 is a critical heap type confusion vulnerability in Apache Fory C++ polymorphic smart-pointer deserialization. Versions from 0.14.0 up to but not including 1.5.0 are affected. A crafted payload can bypass type compatibility checks, causing an incompatible object to be treated as a base type, potentially leading to denial of service or arbitrary code execution. The issue is fixed in Apache Fory 1.5.0. Applications not using this deserialization feature are not affected.