Log in Start free

Vulnerability · Published Jun 7, 2026 · Assigned by VulDB

CVE-2026-11460Boost Serialization improper validation of specified type of input

High 7.3

In plain English

A high-severity improper input validation in Serialization from Boost. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.3%top 75.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw has been found in Boost Serialization. The impacted element is an unknown function. This manipulation causes improper validation of specified type of input. It is possible to initiate the attack remotely. The exploit has been published and may be used. The maintainer was notified on Aug 2025 and a disclosure deadline was set for 90 days. The maintainer acknowledged but postponed indefinitely citing time concerns. No patch is currently available and the disclosure deadline has expired.

Affected products (as reported)

VendorProductVersions
Boost Serialization 1.32.01.33.01.33.11.34.01.34.11.35.01.36.01.37.0

Weakness: CWE-1287, CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References