CVE-2026-64609
Received Received - Intake

Out-of-Bounds Read in Apache Fory via sun.misc.Unsafe

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Apache Software Foundation

Description
Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected. This issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were published under the Maven coordinates org.apache.fury:fury-core. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-64609
EUVD
EUVD-2026-46172

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache fory From 0.5.0 (inc) to 1.4.0 (exc)
apache fory to 0.11.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read issue in Apache Fory caused by the sun.misc.Unsafe class. When using out-of-band zero-copy deserialization, the function readAlignedVarUint() can read beyond the buffer's allocated memory. This feature is optional, so only applications that enable it are affected.

Detection Guidance

Detection requires checking if your Apache Fory version is vulnerable. Use commands like 'mvn dependency:tree' in projects using Fory to verify the version. If using 0.5.0 to 1.3.x, the system is affected.

Impact Analysis

If your application uses out-of-band zero-copy deserialization in Apache Fory versions 0.5.0 to 1.3.0, this flaw could allow reading memory outside the intended buffer. This may lead to crashes, data corruption, or potential information disclosure. Applications not using this feature are not affected.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a technical flaw in Apache Fory's deserialization process that could lead to information disclosure if exploited. Compliance impact would depend on how the affected software is used in a system handling regulated data.

Mitigation Strategies

Upgrade Apache Fory to version 1.4.0 or later. If using Maven, update the dependency in pom.xml to 'org.apache.fury:fury-core:1.4.0'. Remove or disable out-of-band zero-copy deserialization if enabled.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64609. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart