CVE-2026-64609 -- CVSS 9.1 Vulnerability Briefing

CVE-2026-64609 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-64609 is a critical out-of-bounds read vulnerability in Apache Fory's out-of-band zero-copy deserialization path, specifically involving the readAlignedVarUint() method and sun.misc.Unsafe.

Technical Detail

When Apache Fory processes out-of-band zero-copy serialized data, readAlignedVarUint() can read past the bounds of the underlying buffer. An attacker able to supply or influence deserialized data could trigger the condition using malformed input. The provided information identifies an out-of-bounds read, which may cause application instability or disclosure of process memory; remote code execution has not been confirmed.

Exploitation Status

No known exploit has been reported, and CISA has not listed this vulnerability in its Known Exploited Vulnerabilities catalog as of July 28, 2026.

Who Is Targeting This

No specific threat actor attribution at this time.

What To Do

Prioritize applying an Apache-provided fixed version of Fory when available and review application dependencies for direct or transitive use of affected Fory versions. Until patched, avoid processing untrusted or externally supplied serialized data through Fory's out-of-band zero-copy deserialization functionality, and disable or restrict that functionality where operationally feasible. Monitor applications using Fory for deserialization failures, buffer-boundary exceptions, unexpected process crashes, and anomalous requests or messages containing serialized payloads. No vendor workaround or reliable detection signature has been confirmed in the available information.