Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization (CVE-2026-71558) | HOL Guard CVE