Which versions of Boost Serialization are affected by CVE-2026-11460?

Organizations running C++ applications that rely on Boost Serialization face immediate risk from a critical deserialization vulnerability with no vendor patch available and publicly available exploit…

Is there a public PoC exploit available for CVE-2026-11460?

Yes, a public proof-of-concept exploit is available for CVE-2026-11460. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-11460?

Within 24 hours: Inventory all C++ applications and services using Boost Serialization versions up to 1.91 and prioritize those accepting deserialized data from untrusted sources. Within 7 days: Implement network access controls, input validation, and monitoring to detect exploit attempts; evaluate upgrade paths to alternative serialization libraries (e.g., Protocol Buffers, MessagePack, Thrift) for affected applications. Within 30 days: Complete migration planning for high-risk systems or implement hardening measures such as sandboxing deserialization operations and enforcing strict least-privilege network policies for affected services.

Boost Serialization CVE-2026-11460

Q: What is the CVSS score of CVE-2026-11460?

CVE-2026-11460 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-34991 LOW

Improper Validation of Specified Type of Input (CWE-1287)

2026-06-07 VulDB

GHSA-25jx-vqmc-84rq

Information Disclosure Boost Serialization

2.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.9 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 07, 2026 - 20:22 NVD

HIGH LOW

CVSS changed

Jun 07, 2026 - 20:22 NVD

7.3 (HIGH) 2.9 (LOW)

Analysis Generated

Jun 07, 2026 - 20:13 vuln.today

DescriptionCVE.org

A flaw has been found in Boost Serialization up to 1.91. The impacted element is an unknown function. This manipulation causes improper validation of specified type of input. It is possible to initiate the attack remotely. The exploit has been published and may be used. The maintainer was notified on Aug 2025 and a disclosure deadline was set for 90 days. The maintainer acknowledged but postponed indefinitely citing time concerns. No patch is currently available and the disclosure deadline has expired.

AnalysisAI

Improper input type validation in Boost Serialization versions up to 1.91 allows remote attackers to send maliciously crafted serialized data that triggers limited compromise of confidentiality, integrity, and availability. Publicly available exploit code exists (published as a GitHub gist by researcher TrebledJ), and the maintainer has indefinitely postponed a fix after the 90-day disclosure deadline expired, leaving downstream C++ applications using Boost Serialization unpatched. No active exploitation has been confirmed via CISA KEV.

Technical ContextAI

Boost Serialization is a widely-used C++ library within the Boost collection that provides facilities for serializing and deserializing arbitrary C++ data structures to and from archives (binary, text, XML). The flaw maps to CWE-1287 (Improper Validation of Specified Type of Input), meaning the library accepts deserialization input without sufficiently verifying that the supplied type matches expected constraints. Because deserialization routines reconstruct objects from attacker-controlled byte streams, weak type validation in such libraries is a well-known class of vulnerability that can lead to unexpected object instantiation, memory corruption, or logic abuse. The affected CPE is cpe:2.3:a:boost:serialization:*:*:*:*:*:*:*:* covering all versions through 1.91.

RemediationAI

No vendor-released patch identified at time of analysis - the Boost Serialization maintainer acknowledged the report but indefinitely postponed a fix after the 90-day disclosure deadline expired, so consumers cannot upgrade to a fixed release. Until upstream produces a patched version, compensating controls should focus on never deserializing Boost archives from untrusted sources: validate and authenticate serialized payloads before passing them to Boost (e.g., wrap archives in HMAC-signed envelopes or transport them only over mutually-authenticated channels), restrict the set of classes registered for polymorphic deserialization to the minimum required (side effect: any unregistered legitimate type will fail to load), and consider switching exposed deserialization endpoints to a stricter schema-based format such as Protocol Buffers or Cap'n Proto (side effect: significant code changes and loss of arbitrary-object support). Monitor the upstream issue https://github.com/boostorg/serialization/issues/331 for any policy change, and consult https://vuldb.com/vuln/369080 for the published exploit details to inform detection rules.