CVE-2026-71558

{"id": "CVE-2026-71558", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71558", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-07T17:48:07.702770Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Fory", "versions": [{"status": "affected", "version": "0.14.0", "lessThan": "1.5.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-07T10:16:59.337", "references": [{"url": "https://lists.apache.org/thread/oywndv60jwqdv6j37t7bc1qbcc4b235r", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/07/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-502"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-843"}]}], "descriptions": [{"lang": "en", "value": "Heap type confusion vulnerability in Apache Fory C++ deserialization.\n\nThis issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution.\n\n\nUsers are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications not using Apache Fory C++ polymorphic smart-pointer deserialization are not affected."}, {"lang": "es", "value": "Vulnerabilidad de confusi\u00f3n de tipos en el heap en la deserializaci\u00f3n de Apache Fory C++.\n\nEste problema afecta a las versiones de Apache Fory C++ desde la 0.14.0 anteriores a la 1.5.0. Una carga \u00fatil de entrada manipulada puede eludir las comprobaciones de compatibilidad de tipos durante la deserializaci\u00f3n polim\u00f3rfica de punteros inteligentes, haciendo que un objeto de un tipo incompatible sea tratado como el tipo base declarado. Esto puede resultar en un comportamiento indefinido y potencialmente conducir a una denegaci\u00f3n de servicio o ejecuci\u00f3n de c\u00f3digo arbitrario.\n\nSe recomienda a los usuarios actualizar a Apache Fory 1.5.0, que corrige este problema. Las aplicaciones que no utilizan la deserializaci\u00f3n polim\u00f3rfica de punteros inteligentes de Apache Fory C++ no se ven afectadas."}], "lastModified": "2026-10-24T15:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:fory:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "772F10BC-3E7E-4292-A09B-5B981B9C088E", "versionEndExcluding": "1.5.0", "versionStartIncluding": "0.14.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}