EUVD-2026-34994
GHSA-vf62-69cf-f6mv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in USCiLab Cereal up to 1.3.2. Affected is an unknown function of the component Shared Pointer Handler. Executing a manipulation can lead to type confusion. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
AnalysisAI
Type confusion in USCiLab Cereal C++ serialization library through version 1.3.2 allows remote attackers to trigger memory corruption via the Shared Pointer Handler component when deserializing untrusted input. Publicly available exploit code exists (published as a GitHub gist), and the issue was disclosed by VulDB after early vendor contact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target application must call into USCiLab Cereal (≤1.3.2) to deserialize attacker-influenced data that exercises the Shared Pointer Handler - i.e., the payload must include polymorphic std::shared_ptr graphs, since non-shared-pointer Cereal usage does not reach the vulnerable code path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) yields 7.3 and indicates network-reachable, unauthenticated exploitation with no user interaction, but only partial impact on each CIA dimension - consistent with type-confusion that corrupts a deserialized object rather than yielding straightforward RCE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies an application that accepts Cereal-serialized data over a network channel (for example, an RPC endpoint, message queue consumer, or save-game loader) and crafts a payload that abuses the Shared Pointer Handler to coerce a polymorphic shared_ptr into being interpreted as an incompatible type. Using the publicly disclosed proof-of-concept gist as a template, the attacker triggers type confusion to leak adjacent memory or corrupt object state, then pivots toward control-flow hijack or sensitive data disclosure within the host process. … |
| Remediation | No vendor-released patch identified at time of analysis - the referenced GitHub issue (https://github.com/USCiLab/cereal/issues/870) tracks the report but the data does not confirm a tagged release containing a fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct comprehensive inventory of all systems, applications, and dependencies using Cereal library version 1.3.2 or earlier (including transitive dependencies, development environments, and compiled artifacts). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today