Is there a public PoC exploit available for EUVD-2026-31780?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31780. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for EUVD-2026-31780?

Yes, a patch is available for EUVD-2026-31780. Update the affected software to the latest version immediately.

bitsery EUVD-2026-31780

Q: What is the CVSS score of EUVD-2026-31780?

EUVD-2026-31780 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-9521 LOW

Improper Validation of Specified Type of Input (CWE-1287)

2026-05-26 VulDB

GHSA-xvwh-vh35-wwv2

Information Disclosure Bitsery

2.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.9 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 13:03 vuln.today

Analysis Generated

Jun 08, 2026 - 13:03 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

HIGH LOW

CVSS changed

May 26, 2026 - 20:07 NVD

7.3 (HIGH) 2.9 (LOW)

DescriptionCVE.org

A security vulnerability has been detected in fraillt bitsery up to 5.2.4. Affected is the function loadFromSharedState in the library include/bitsery/ext/std_smart_ptr.h. Such manipulation leads to improper validation of specified type of input. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 5.2.5 is able to address this issue. The name of the patch is 66d16516e24893bebc1c8af52bf2fe9ad0735061. Upgrading the affected component is advised.

AnalysisAI

Improper type validation in fraillt bitsery's smart pointer deserialization extension exposes applications that process attacker-controlled serialized data to partial confidentiality, integrity, and availability compromise. The vulnerable function loadFromSharedState in include/bitsery/ext/std_smart_ptr.h fails to validate polymorphic type identity before performing reinterpret_cast operations, allowing a remote unauthenticated attacker to supply crafted serialized input that triggers unsafe memory access. A publicly available proof-of-concept exploit exists (GitHub gist), though EPSS remains very low at 0.07% (21st percentile) and this CVE is not listed in CISA KEV, suggesting no observed widespread exploitation at time of analysis.

Technical ContextAI

bitsery is a C++ header-only binary serialization library (CPE: cpe:2.3:a:fraillt:bitsery:*:*:*:*:*:*:*:*). The vulnerability resides in the smart pointer extension (include/bitsery/ext/std_smart_ptr.h) and its supporting pointer management infrastructure (include/bitsery/ext/pointer.h, include/bitsery/ext/utils/pointer_utils.h). The root cause is CWE-1287 (Improper Validation of Specified Type of Input): during deserialization of polymorphic smart pointer types, the library performed reinterpret_cast from a stored shared_ptr base to a derived TElement type without validating that the stored object's runtime type is actually compatible with the cast target. The patch introduces a sharedTypeId field in PLCInfoDeserializer to track the polymorphic type identity of shared objects and adds a dedicated loadFromSharedStatePolymorphic path that performs type-checked aliasing via shared_ptr aliasing constructors. Additionally, the NoRTTI struct - which always returned isPolymorphic() as false - was removed, and raw PolymorphicHandlerBase references were replaced with const std::shared_ptr<PolymorphicHandlerBase> to enforce shared ownership and type safety. The attack surface exists wherever an application deserializes attacker-supplied binary data into polymorphic pointer types using bitsery's extension API.

RemediationAI

Upgrade bitsery to version 5.2.5 or later - the vendor-released patch is available at https://github.com/fraillt/bitsery/releases/tag/v5.2.5, with the specific fix applied in commit 66d16516e24893bebc1c8af52bf2fe9ad0735061. The changelog entry at https://github.com/fraillt/bitsery/blob/master/CHANGELOG.md#525-2025-10-09 documents the release. If immediate upgrade is not possible, the primary compensating control is to avoid deserializing untrusted or externally sourced binary data using bitsery's polymorphic smart pointer extensions (PointerOwner, PointerObserver, ReferencedByPointer with polymorphic types); applications that only deserialize internally generated or cryptographically authenticated data are not exposed. Restricting network-facing endpoints that invoke bitsery deserialization with polymorphic pointer types to trusted sources is a secondary mitigation, though it does not eliminate the underlying flaw. No trade-offs affect the patch itself; the fix is an API-compatible internal change to type identity checking logic.