CVE-2026-11460: Boost Serialization improper validation of specified type of input
A flaw has been found in Boost Serialization up to 1.91. The impacted element is an unknown function. This manipulation causes improper validation of specified type of input. It is possible to initiate the attack remotely. The exploit has been published and may be used. The maintainer was notified on Aug 2025 and a disclosure deadline was set for 90 days. The maintainer acknowledged but postponed indefinitely citing time concerns. No patch is currently available and the disclosure deadline has expired.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11460?
The severity of CVE-2026-11460 is rated as high with a score of 7.3.
How do I fix CVE-2026-11460?
To fix CVE-2026-11460, upgrade to the latest version of Boost Serialization that addresses this vulnerability.
What type of flaw is associated with CVE-2026-11460?
CVE-2026-11460 is associated with improper validation of specified types of input.
Can CVE-2026-11460 be exploited remotely?
Yes, CVE-2026-11460 can be exploited remotely.
What versions of Boost Serialization are affected by CVE-2026-11460?
Boost Serialization versions up to 1.91 are affected by CVE-2026-11460.