CVE-2026-11460

{"id": "CVE-2026-11460", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11460", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-08T13:45:37.162774Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:boost:serialization:*:*:*:*:*:*:*:*"], "vendor": "Boost", "product": "Serialization", "versions": [{"status": "affected", "version": "1.0"}, {"status": "affected", "version": "1.1"}, {"status": "affected", "version": "1.2"}, {"status": "affected", "version": "1.3"}, {"status": "affected", "version": "1.4"}, {"status": "affected", "version": "1.5"}, {"status": "affected", "version": "1.6"}, {"status": "affected", "version": "1.7"}, {"status": "affected", "version": "1.8"}, {"status": "affected", "version": "1.9"}, {"status": "affected", "version": "1.10"}, {"status": "affected", "version": "1.11"}, {"status": "affected", "version": "1.12"}, {"status": "affected", "version": "1.13"}, {"status": "affected", "version": "1.14"}, {"status": "affected", "version": "1.15"}, {"status": "affected", "version": "1.16"}, {"status": "affected", "version": "1.17"}, {"status": "affected", "version": "1.18"}, {"status": "affected", "version": "1.19"}, {"status": "affected", "version": "1.20"}, {"status": "affected", "version": "1.21"}, {"status": "affected", "version": "1.22"}, {"status": "affected", "version": "1.23"}, {"status": "affected", "version": "1.24"}, {"status": "affected", "version": "1.25"}, {"status": "affected", "version": "1.26"}, {"status": "affected", "version": "1.27"}, {"status": "affected", "version": "1.28"}, {"status": "affected", "version": "1.29"}, {"status": "affected", "version": "1.30"}, {"status": "affected", "version": "1.31"}, {"status": "affected", "version": "1.32"}, {"status": "affected", "version": "1.33"}, {"status": "affected", "version": "1.34"}, {"status": "affected", "version": "1.35"}, {"status": "affected", "version": "1.36"}, {"status": "affected", "version": "1.37"}, {"status": "affected", "version": "1.38"}, {"status": "affected", "version": "1.39"}, {"status": "affected", "version": "1.40"}, {"status": "affected", "version": "1.41"}, {"status": "affected", "version": "1.42"}, {"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.45"}, {"status": "affected", "version": "1.46"}, {"status": "affected", "version": "1.47"}, {"status": "affected", "version": "1.48"}, {"status": "affected", "version": "1.49"}, {"status": "affected", "version": "1.50"}, {"status": "affected", "version": "1.51"}, {"status": "affected", "version": "1.52"}, {"status": "affected", "version": "1.53"}, {"status": "affected", "version": "1.54"}, {"status": "affected", "version": "1.55"}, {"status": "affected", "version": "1.56"}, {"status": "affected", "version": "1.57"}, {"status": "affected", "version": "1.58"}, {"status": "affected", "version": "1.59"}, {"status": "affected", "version": "1.60"}, {"status": "affected", "version": "1.61"}, {"status": "affected", "version": "1.62"}, {"status": "affected", "version": "1.63"}, {"status": "affected", "version": "1.64"}, {"status": "affected", "version": "1.65"}, {"status": "affected", "version": "1.66"}, {"status": "affected", "version": "1.67"}, {"status": "affected", "version": "1.68"}, {"status": "affected", "version": "1.69"}, {"status": "affected", "version": "1.70"}, {"status": "affected", "version": "1.71"}, {"status": "affected", "version": "1.72"}, {"status": "affected", "version": "1.73"}, {"status": "affected", "version": "1.74"}, {"status": "affected", "version": "1.75"}, {"status": "affected", "version": "1.76"}, {"status": "affected", "version": "1.77"}, {"status": "affected", "version": "1.78"}, {"status": "affected", "version": "1.79"}, {"status": "affected", "version": "1.80"}, {"status": "affected", "version": "1.81"}, {"status": "affected", "version": "1.82"}, {"status": "affected", "version": "1.83"}, {"status": "affected", "version": "1.84"}, {"status": "affected", "version": "1.85"}, {"status": "affected", "version": "1.86"}, {"status": "affected", "version": "1.87"}, {"status": "affected", "version": "1.88"}, {"status": "affected", "version": "1.89"}, {"status": "affected", "version": "1.90"}, {"status": "affected", "version": "1.91"}]}]}], "published": "2026-06-07T20:16:39.993", "references": [{"url": "https://gist.github.com/TrebledJ/b7c872f869b5ed7cbd936f71f16c7d75", "source": "cna@vuldb.com"}, {"url": "https://github.com/boostorg/serialization/issues/331", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-11460", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/814455", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/369080", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/369080/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-1287"}]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in Boost Serialization up to 1.91. The impacted element is an unknown function. This manipulation causes improper validation of specified type of input. It is possible to initiate the attack remotely. The exploit has been published and may be used. The maintainer was notified on Aug 2025 and a disclosure deadline was set for 90 days. The maintainer acknowledged but postponed indefinitely citing time concerns. No patch is currently available and the disclosure deadline has expired."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en Boost Serialization hasta la versi\u00f3n 1.91. El elemento afectado es una funci\u00f3n desconocida. Esta manipulaci\u00f3n provoca una validaci\u00f3n inadecuada del tipo de entrada especificado. Es posible iniciar el ataque remotamente. El exploit ha sido publicado y puede ser utilizado. El mantenedor fue notificado en agosto de 2025 y se estableci\u00f3 una fecha l\u00edmite de divulgaci\u00f3n de 90 d\u00edas. El mantenedor reconoci\u00f3, pero pospuso indefinidamente alegando problemas de tiempo. Ning\u00fan parche est\u00e1 actualmente disponible y la fecha l\u00edmite de divulgaci\u00f3n ha expirado."}], "lastModified": "2026-07-23T07:10:00.113", "sourceIdentifier": "cna@vuldb.com"}