CVE-2026-71560

Name of the Vulnerable Software and Affected Versions Apache Fory C++ versions 0.14.0 through 1.4.x

Description An out-of-bounds read issue exists during the deserialization of structs containing tagged integer fields. A crafted input payload can trigger an out-of-bounds heap read within the tagged integer fast-path deserializer, which may lead to denial of service or information disclosure.

Recommendations Upgrade to version 1.5.0. Restrict the use of tagged integer fields during deserialization as a temporary mitigation.