CVE-2026-71558

criticalCVSS 9.8covered by 1 sourcefirst seen 2026-08-07

Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution. Users are recommended to upgrade to Apache Fory 1.5.0, which fixes this issue. Applications not using Apache Fory C++ polymorphic smart-pointer deserialization are not affected.

⚡ Watch CVE-2026-71558

Get an email if CVE-2026-71558 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.53% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all EPSS-scored CVEs.

Advisory coverage (1)

criticalCVE-2026-71558: Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apach…nvd · 2026-08-07

External references

NVD record for CVE-2026-71558

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-71558 status](https://www.csirts.com/badge/CVE-2026-71558)](https://www.csirts.com/cve/CVE-2026-71558)