A critical heap type confusion vulnerability in Apache Fory C++ versions 0.14.0 through 1.4.x poses a severe risk of arbitrary code execution.

This is a deserialization vulnerability (CWE-502) occurring in the C++ implementation. An unauthenticated attacker can send a crafted input payload that bypasses type compatibility checks, leading to memory corruption and potential code execution.

The vulnerability carries a CVSS score of 9.8, reflecting its critical nature and ease of remote exploitation. Successful exploitation could lead to full system compromise, loss of data integrity, and significant operational downtime, directly impacting the availability and security of services relying on this library.

Immediate Action: Upgrade to Apache Fory version 1.5.0 or later immediately to resolve the deserialization flaw.

Proactive Monitoring: Monitor application logs for unusual deserialization errors or unexpected process crashes that may indicate exploitation attempts.

Compensating Controls: If upgrading is not immediately possible, disable the use of polymorphic smart-pointer deserialization within the application if it is not strictly required.

Public Exploit Available: Unknown

Given the critical CVSS severity of 9.8, organizations should prioritize updating the Apache Fory library to version 1.5.0 across all environments. Failure to address this vulnerability leaves systems exposed to potential remote code execution attacks.