CVE-2026-64608 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-64608 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-64608 is a critical heap type-confusion and out-of-bounds read/write vulnerability in the Apache Fory C++ implementation when it deserializes data in compatible mode.

Technical Detail

The vulnerable field-skip paths do not correctly validate declared field type information during compatible-mode deserialization. An attacker able to supply crafted serialized data to a Fory C++ deserialization endpoint may trigger invalid heap memory access, including out-of-bounds reads and writes. Successful exploitation could cause process crashes, memory disclosure, data corruption, or potentially remote code execution in the context of the affected process.

Exploitation Status

No known exploit has been reported as of July 28, 2026. CVE-2026-64608 is not listed in CISA's Known Exploited Vulnerabilities catalog.

Who Is Targeting This

No specific threat actor attribution at this time.

What To Do

Treat this as a high-priority patching issue for systems using the Apache Fory C++ implementation, particularly where untrusted or externally sourced serialized data can reach compatible-mode deserialization. Apply an upstream security fix or upgrade to a remediated Apache Fory release when available; a fixed version is not identified in the supplied data. Until patching is complete, prevent untrusted parties from submitting Fory serialized payloads, disable compatible-mode deserialization where operationally feasible, and isolate services that must process untrusted data. Monitor affected services for unexpected crashes, memory-access exceptions, malformed serialization errors, and anomalous requests containing serialized data.