The vulnerability is a heap type confusion combined with an out‑of‑bounds memory read and write in the Apache Fory C++ deserialization logic. When data is processed in compatible mode, the field‑skip routines fail to verify that the declared field type matches the actual payload, allowing an attacker to supply a crafted input that triggers type confusion and memory corruption. This can lead to arbitrary code execution or a crash, compromising confidentiality, integrity, and availability of the affected system.

Apache Software Foundation’s Apache Fory C++ implementation is impacted, covering versions 0.14.0 through before 1.4.0. The issue does not affect the other language bindings of Apache Fory.

The CVSS base score of 9.8 signifies high severity, and the EPSS value of less than 1% indicates a low exploitation probability in the current environment, although the vulnerability remains a high-risk due to the lack of remediation in affected installations. Based on the description, it is inferred that an attacker could supply crafted serialized data to a vulnerable deserialization endpoint, typically via any network interface exposed by the Fory server. No public exploit code has been disclosed and the vulnerability is not listed in CISA’s KEV catalog, but given the critical score, organizations should treat it as a high‑risk exposure.