Out‑of‑bounds read vulnerability in the Apache Fory library occurs when the opt‑in zero‑copy deserialization feature causes the readAlignedVarUint() routine to read past the end an attacker to access memory that should not be exposed, potentially disclosing sensitive data or corrupting application state. The flaw does not provide direct code execution but can lead to information leakage, crashes, or unpredictable behavior.

Apache Software Foundation’s product Apache Fory (formerly Apache Fury) is affected from version 0.5.0 up to, but not including, 1.4.0. All earlier releases of the library, including those published under the Maven coordinates org.apache.fury:fury-core before 0.11.0, are vulnerable.

The CVSS score of 9.1 reflects the high potential impact of the memory read, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild at this time. The vulnerability is not listed in the CISA KEV catalog. Because the issue is activated only when an application enables zero‑copy deserialization, the attack vector is limited to environments where this is in use. If an adversary can supply a crafted serialized payload to such a system, the out‑of‑bounds read may reveal internal data or trigger crashes.