CVE-2026-11460
Full vulnerability record from the local CVENow database.
Description
A flaw has been found in Boost Serialization. The impacted element is an unknown function. This manipulation causes improper validation of specified type of input. It is possible to initiate the attack remotely. The exploit has been published and may be used. The maintainer was notified on Aug 2025 and a disclosure deadline was set for 90 days. The maintainer acknowledged but postponed indefinitely citing time concerns. No patch is currently available and the disclosure deadline has expired.
Severity
LOW
CVSS score
2.9
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-06-07 20:16:39.993000
Last modified
2026-11-02 21:17:29.543000
View original CVE JSON
{
"id": "CVE-2026-11460",
"sourceIdentifier": "[email protected]",
"published": "2026-06-07T20:16:39.993",
"lastModified": "2026-11-02T21:17:29.543",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Boost Serialization. The impacted element is an unknown function. This manipulation causes improper validation of specified type of input. It is possible to initiate the attack remotely. The exploit has been published and may be used. The maintainer was notified on Aug 2025 and a disclosure deadline was set for 90 days. The maintainer acknowledged but postponed indefinitely citing time concerns. No patch is currently available and the disclosure deadline has expired."
},
{
"lang": "es",
"value": "Se ha encontrado una vulnerabilidad en Boost Serialization hasta la versión 1.91. El elemento afectado es una función desconocida. Esta manipulación provoca una validación inadecuada del tipo de entrada especificado. Es posible iniciar el ataque remotamente. El exploit ha sido publicado y puede ser utilizado. El mantenedor fue notificado en agosto de 2025 y se estableció una fecha límite de divulgación de 90 días. El mantenedor reconoció, pero pospuso indefinidamente alegando problemas de tiempo. Ningún parche está actualmente disponible y la fecha límite de divulgación ha expirado."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Boost",
"product": "Serialization",
"cpes": [
"cpe:2.3:a:boost:serialization:*:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "1.32.0",
"status": "affected"
},
{
"version": "1.33.0",
"status": "affected"
},
{
"version": "1.33.1",
"status": "affected"
},
{
"version": "1.34.0",
"status": "affected"
},
{
"version": "1.34.1",
"status": "affected"
},
{
"version": "1.35.0",
"status": "affected"
},
{
"version": "1.36.0",
"status": "affected"
},
{
"version": "1.37.0",
"status": "affected"
},
{
"version": "1.38.0",
"status": "affected"
},
{
"version": "1.39.0",
"status": "affected"
},
{
"version": "1.40.0",
"status": "affected"
},
{
"version": "1.41.0",
"status": "affected"
},
{
"version": "1.42.0",
"status": "affected"
},
{
"version": "1.43.0",
"status": "affected"
},
{
"version": "1.44.0",
"status": "affected"
},
{
"version": "1.45.0",
"status": "affected"
},
{
"version": "1.46.0",
"status": "affected"
},
{
"version": "1.46.1",
"status": "affected"
},
{
"version": "1.47.0",
"status": "affected"
},
{
"version": "1.48.0",
"status": "affected"
},
{
"version": "1.49.0",
"status": "affected"
},
{
"version": "1.50.0",
"status": "affected"
},
{
"version": "1.51.0",
"status": "affected"
},
{
"version": "1.52.0",
"status": "affected"
},
{
"version": "1.53.0",
"status": "affected"
},
{
"version": "1.54.0",
"status": "affected"
},
{
"version": "1.55.0",
"status": "affected"
},
{
"version": "1.56.0",
"status": "affected"
},
{
"version": "1.57.0",
"status": "affected"
},
{
"version": "1.58.0",
"status": "affected"
},
{
"version": "1.59.0",
"status": "affected"
},
{
"version": "1.60.0",
"status": "affected"
},
{
"version": "1.61.0",
"status": "affected"
},
{
"version": "1.62.0",
"status": "affected"
},
{
"version": "1.63.0",
"status": "affected"
},
{
"version": "1.64.0",
"status": "affected"
},
{
"version": "1.65.0",
"status": "affected"
},
{
"version": "1.65.1",
"status": "affected"
},
{
"version": "1.66.0",
"status": "affected"
},
{
"version": "1.67.0",
"status": "affected"
},
{
"version": "1.68.0",
"status": "affected"
},
{
"version": "1.69.0",
"status": "affected"
},
{
"version": "1.70.0",
"status": "affected"
},
{
"version": "1.71.0",
"status": "affected"
},
{
"version": "1.72.0",
"status": "affected"
},
{
"version": "1.73.0",
"status": "affected"
},
{
"version": "1.74.0",
"status": "affected"
},
{
"version": "1.75.0",
"status": "affected"
},
{
"version": "1.76.0",
"status": "affected"
},
{
"version": "1.77.0",
"status": "affected"
},
{
"version": "1.78.0",
"status": "affected"
},
{
"version": "1.79.0",
"status": "affected"
},
{
"version": "1.80.0",
"status": "affected"
},
{
"version": "1.81.0",
"status": "affected"
},
{
"version": "1.82.0",
"status": "affected"
},
{
"version": "1.83.0",
"status": "affected"
},
{
"version": "1.84.0",
"status": "affected"
},
{
"version": "1.85.0",
"status": "affected"
},
{
"version": "1.86.0",
"status": "affected"
},
{
"version": "1.87.0",
"status": "affected"
},
{
"version": "1.88.0",
"status": "affected"
},
{
"version": "1.89.0",
"status": "affected"
},
{
"version": "1.90.0",
"status": "affected"
},
{
"version": "1.91.0",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 2.9,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 3.9,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"baseScore": 7.5,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "HIGH",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-08T13:45:37.162774Z",
"id": "CVE-2026-11460",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-20"
},
{
"lang": "en",
"value": "CWE-1287"
}
]
}
],
"references": [
{
"url": "https://gist.github.com/TrebledJ/b7c872f869b5ed7cbd936f71f16c7d75",
"source": "[email protected]"
},
{
"url": "https://github.com/boostorg/serialization/issues/331",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-11460",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/814455",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/369080",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/369080/cti",
"source": "[email protected]"
}
]
}