A heap type confusion flaw in Apache Fory’s C++ polymorphic smart‑pointer deserialization permits a crafted payload to bypass type compatibility checks. The vulnerability allows an attacker to cause an object of an incompatible type to be interpreted as the declared base type, leading to undefined behavior that may manifest as denial‑of‑service or arbitrary code execution. The weaknesses are identified as CWE‑502 and CWE‑843. The CVSS score of 9.8 confirms the severity, and the potential for RCE indicates a high‑risk impact.

The flaw affects Apache Fory from version 0.14.0 up to but not including 1.5.0. The affected vendor is the Apache Software Foundation. Applications that rely on Apache Fory’s polymorphic smart‑pointer deserialization are susceptible; those that do not use this deserialization path remain unaffected.

The CVSS score of 9.8 indicates a severe vulnerability, and the EPSS score of < 1% shows a very low but non‑zero exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Despite the low EPSS, the potential for arbitrary code execution necessitates that organizations treat it as high risk. Based on the description, an attacker would need to supply a maliciously crafted payload that targets the deserialization process; the specific delivery mechanisms are not described, so we cannot confirm whether network services, files, or other input interfaces are involved. The absence of publicly known exploits does not diminish the intrinsic danger posed by this type confusion.