What is the CVSS score of CVE-2026-11460?

CVE-2026-11460 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-11460?

Yes, a public proof-of-concept exploit is available for CVE-2026-11460. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-11460?

Within 24 hours: Inventory all C++ applications and services using Boost Serialization versions up to 1.91 and prioritize those accepting deserialized data from untrusted sources. Within 7 days: Implement network access controls, input validation, and monitoring to detect exploit attempts; evaluate upgrade paths to alternative serialization libraries (e.g., Protocol Buffers, MessagePack, Thrift) for affected applications. Within 30 days: Complete migration planning for high-risk systems or implement hardening measures such as sandboxing deserialization operations and enforcing strict least-privilege network policies for affected services.

Boost Serialization CVE-2026-11460

EUVD-2026-34991 LOW

Improper Validation of Specified Type of Input (CWE-1287)

2026-06-07 VulDB

GHSA-25jx-vqmc-84rq

Information Disclosure Boost Serialization

2.9

CVSS 4.0 · Vendor: VulDB

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify app using vulnerable Boost Serialization
Delivery

Locate exposed deserialization endpoint
Exploit

Craft malicious archive payload
Execution

Submit payload over network
Persist

Trigger improper type validation
Impact

Achieve limited disclosure or corruption

Vulnerability Assessment

Weakness	CWE CWE-1287 ASVS 5.0 V2 - Validation and Business Logic Specified type validation
Exploitation Conditions	Exploitation requires that the target application uses an affected Boost Serialization version (≤1.91) AND exposes a deserialization code path to attacker-controlled archive data - Boost Serialization is a library, not a network service, so the network attack vector in CVSS reflects the downstream application's exposure, not the library's. Limiting factors: the attacker must know or guess the archive format (binary/text/XML) used by the target, the target must register types in a way that the validation flaw can be abused, and impact is bounded by CVSS to Low across CIA rather than full code execution. There are no authentication or user-interaction prerequisites per CVSS (PR:N/UI:N), and a public PoC is available to reduce the skill barrier.
Impact	The CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) signals a network-reachable, low-complexity, unauthenticated attack with limited impact across CIA - consistent with information disclosure or partial corruption rather than full RCE. The temporal metrics (E:P, RC:R) indicate a proof-of-concept exists but exploit maturity and report confidence are only 'Reasonable,' and RL:X means remediation level is undefined (which aligns with the maintainer's refusal to patch). A publicly available PoC combined with the absence of any patch raises the practical risk meaningfully, but the vulnerability is not listed in CISA KEV and no EPSS score was provided, so widespread automated exploitation cannot be confirmed. The single intelligence source (VulDB) and the indirect attack model - Boost Serialization is a library, not a network service, so exploitability depends entirely on how downstream applications expose deserialization to untrusted input - suggest this is more of a supply-chain hygiene concern than an immediate internet-wide threat.
Exploit ScenarioDerived	An attacker identifies an application (for example a network daemon, RPC service, or file processor) that accepts Boost-serialized payloads from external sources and submits a crafted archive whose type metadata bypasses the library's type validation. Because publicly available PoC code exists in the referenced GitHub gist, an attacker can adapt it to trigger information disclosure or limited integrity/availability impact against the target process without authentication or user interaction.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 07, 2026

Improper input type validation in Boost Serialization versions up to 1.91 allows remote attackers to send maliciously crafted serialized data that triggers limited compromise of confidentiality, integrity, and availability. Publicly available exploit code exists (published as a GitHub gist by researcher TrebledJ), and the maintainer has indefinitely postponed a fix after the 90-day disclosure deadline expired, leaving downstream C++ applications using Boost Serialization unpatched. No active exploitation has been confirmed via CISA KEV.

RemediationAI

No vendor-released patch identified at time of analysis - the Boost Serialization maintainer acknowledged the report but indefinitely postponed a fix after the 90-day disclosure deadline expired, so consumers cannot upgrade to a fixed release. Until upstream produces a patched version, compensating controls should focus on never deserializing Boost archives from untrusted sources: validate and authenticate serialized payloads before passing them to Boost (e.g., wrap archives in HMAC-signed envelopes or transport them only over mutually-authenticated channels), restrict the set of classes registered for polymorphic deserialization to the minimum required (side effect: any unregistered legitimate type will fail to load), and consider switching exposed deserialization endpoints to a stricter schema-based format such as Protocol Buffers or Cap'n Proto (side effect: significant code changes and loss of arbitrary-object support). Monitor the upstream issue https://github.com/boostorg/serialization/issues/331 for any policy change, and consult https://vuldb.com/vuln/369080 for the published exploit details to inform detection rules.

Affected VersionsENISA

Serialization 1.5

Serialization 1.15

Serialization 1.66

Serialization 1.41

Serialization 1.32

Serialization 1.63

Serialization 1.52

Serialization 1.91

Serialization 1.46

Serialization 1.69

Serialization 1.33

Serialization 1.13

Serialization 1.1

Serialization 1.44

Serialization 1.23

Serialization 1.89

Serialization 1.42

Serialization 1.61

Serialization 1.28

Serialization 1.50

Serialization 1.0

Serialization 1.8

Serialization 1.73

Serialization 1.85

Serialization 1.26

Serialization 1.10

Serialization 1.12

Serialization 1.90

Serialization 1.14

Serialization 1.37

Serialization 1.19

Serialization 1.47

Serialization 1.43

Serialization 1.80

Serialization 1.56

Serialization 1.88

Serialization 1.48

Serialization 1.45

Serialization 1.38

Serialization 1.29

Serialization 1.86

Serialization 1.57

Serialization 1.22

Serialization 1.2

Serialization 1.18

Serialization 1.87

Serialization 1.21

Serialization 1.62

Serialization 1.6

Serialization 1.30

Serialization 1.79

Serialization 1.59

Serialization 1.53

Serialization 1.36

Serialization 1.64

Serialization 1.58

Serialization 1.60

Serialization 1.65

Serialization 1.68

Serialization 1.39

Serialization 1.49

Serialization 1.9

Serialization 1.16

Serialization 1.77

Serialization 1.71

Serialization 1.27

Serialization 1.11

Serialization 1.81

Serialization 1.82

Serialization 1.84

Serialization 1.67

Serialization 1.78

Serialization 1.75

Serialization 1.54

Serialization 1.74

Serialization 1.40

Serialization 1.17

Serialization 1.55

Serialization 1.20

Serialization 1.34

Serialization 1.25

Serialization 1.4

Serialization 1.70

Serialization 1.24

Serialization 1.51

Serialization 1.7

Serialization 1.76

Serialization 1.31

Serialization 1.72

Serialization 1.83

Serialization 1.35

Serialization 1.3

Affected Packages

euvd serialization no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Boost Serialization is a widely-used C++ library within the Boost collection that provides facilities for serializing and deserializing arbitrary C++ data structures to and from archives (binary, text, XML). The flaw maps to CWE-1287 (Improper Validation of Specified Type of Input), meaning the library accepts deserialization input without sufficiently verifying that the supplied type matches expected constraints. Because deserialization routines reconstruct objects from attacker-controlled byte streams, weak type validation in such libraries is a well-known class of vulnerability that can lead to unexpected object instantiation, memory corruption, or logic abuse. The affected CPE is cpe:2.3:a:boost:serialization:*:*:*:*:*:*:*:* covering all versions through 1.91.

Know when Boost gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulDB) PRIMARY 2.9 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Severity Changed

Jun 07, 2026 - 20:22 NVD

HIGH LOW

CVSS changed

Jun 07, 2026 - 20:22 NVD

7.3 (HIGH) 2.9 (LOW)

DescriptionCVE.org

A flaw has been found in Boost Serialization up to 1.91. The impacted element is an unknown function. This manipulation causes improper validation of specified type of input. It is possible to initiate the attack remotely. The exploit has been published and may be used. The maintainer was notified on Aug 2025 and a disclosure deadline was set for 90 days. The maintainer acknowledged but postponed indefinitely citing time concerns. No patch is currently available and the disclosure deadline has expired.

Executive ViewAI

Why It Matters

Organizations running C++ applications that rely on Boost Serialization face immediate risk from a critical deserialization vulnerability with no vendor patch available and publicly available exploit code in circulation. The vulnerability enables attackers to compromise data confidentiality, system integrity, and application availability with a single malicious network request to any service accepting serialized data.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include: (1) Restrict network access to services performing Boost Serialization deserialization; (2) Implement input validation and integrity checks prior to deserialization; (3) Disable Boost Serialization features if not critical to operations; (4) Evaluate and migrate to alternative serialization libraries not affected by this class of vulnerability; (5) Deploy runtime monitoring and alerting for unusual deserialization activity patterns.

Threat Intelligence Overview

EPSS Score

0.1%

Top 79% exploitable

Exploit

POC

Public exploit code exists

Social Media

Sightings

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Out-of-Cycle

Exploitation

Poc

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +14

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.