CVE-2026-11463
USCiLab Cereal Shared Pointer type confusion
- State
- Published
- Severity
- 6.3 Medium
- Published
- Jun 7, 2026
- Updated
- Jun 9, 2026
- Reserved
- Jun 7, 2026
Description
A vulnerability was determined in USCiLab Cereal up to 1.3.2. Affected is an unknown function of the component Shared Pointer Handler. Executing a manipulation can lead to type confusion. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.3 Medium | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-843 Type Confusion
Affected Products
| Product | Versions |
|---|---|
CerealUSCiLab |
|
References
- VDB-369083 | USCiLab Cereal Shared Pointer type confusionvdb-entry
- VDB-369083 | CTI Indicators (IOB, IOC)signaturepermissions-required
- CVE-2026-11463 | CVE Analysis and Reportthird-party-advisory
- Submit #814456 | USCiLab cereal 1.3.2 CWE-1287, CWE-843 (Type Confusion)third-party-advisory
- https://github.com/USCiLab/cereal/issues/870issue-tracking
- https://gist.github.com/TrebledJ/0223c1fa3c3fd64e2c7047b8a4385ec0exploit
- https://github.com/USCiLab/cereal/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.