The vulnerability is an out‑of‑bounds heap read that occurs when Apache Fory C++ deserializes structs containing tagged integer fields. A crafted input can cause the deserializer to read beyond allocated memory, potentially exposing internal data and allowing a denial‑of‑service condition if the read triggers a fault. The weakness is an out‑of‑bounds read flaw as classified by CWE‑125.

The problem is present in Apache Fory C++ versions from 0.14.0 up to, but not including, 1.5.0. Any application that uses Apache Fory and employs tagged integer fields in its data structures is affected. Applications that do not use the library or do not use the tagged integer feature are not impacted.

Based on the description, it is inferred that a remote attacker could trigger the out‑of‑bounds read by supplying crafted serialized data to the vulnerable application. The CVSS score is 9.1 and the EPSS score is < 1%, indicating a high severity but low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Because the impact includes possible information disclosure, the risk to confidential data is significant, especially for exposed services.