CVE-2026-11460

Boost Serialization improper validation of specified type of input

State: Published
Severity: 6.3 Medium
Published: Jun 7, 2026
Updated: Jun 8, 2026
Reserved: Jun 7, 2026

Description

A flaw has been found in Boost Serialization up to 1.91. The impacted element is an unknown function. This manipulation causes improper validation of specified type of input. It is possible to initiate the attack remotely. The exploit has been published and may be used. The maintainer was notified on Aug 2025 and a disclosure deadline was set for 90 days. The maintainer acknowledged but postponed indefinitely citing time concerns. No patch is currently available and the disclosure deadline has expired.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	7.3 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-1287 Improper Validation of Specified Type of Input
CWE-20 Improper Input Validation

Affected Products

Product	Versions
SerializationBoost	1.0Affected 1.1Affected 1.2Affected 1.3Affected 1.4Affected 1.5Affected 1.6Affected 1.7Affected 1.8Affected 1.9Affected 1.10Affected 1.11Affected 1.12Affected 1.13Affected 1.14Affected 1.15Affected 1.16Affected 1.17Affected 1.18Affected 1.19Affected 1.20Affected 1.21Affected 1.22Affected 1.23Affected 1.24Affected and 67 more versions

References

VDB-369080 | Boost Serialization improper validation of specified type of inputvdb-entry
VDB-369080 | CTI Indicators (IOB, IOC)signaturepermissions-required
CVE-2026-11460 | CVE Analysis and Reportthird-party-advisory
Submit #814455 | boostorg boost serialization 1.91 CWE-1287, CWE-843 (Type Confusion)third-party-advisory
https://github.com/boostorg/serialization/issues/331issue-tracking
https://gist.github.com/TrebledJ/b7c872f869b5ed7cbd936f71f16c7d75exploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.