High severity7.3NVD Advisory· Published Jun 7, 2026· Updated Jun 8, 2026

CVE-2026-11460

Description

A flaw has been found in Boost Serialization up to 1.91. The impacted element is an unknown function. This manipulation causes improper validation of specified type of input. It is possible to initiate the attack remotely. The exploit has been published and may be used. The maintainer was notified on Aug 2025 and a disclosure deadline was set for 90 days. The maintainer acknowledged but postponed indefinitely citing time concerns. No patch is currently available and the disclosure deadline has expired.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Boost/Serializationreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=1.91

Patches

Vulnerability mechanics

References

gist.github.com/TrebledJ/b7c872f869b5ed7cbd936f71f16c7d75nvd
github.com/boostorg/serialization/issues/331nvd
vuldb.com/cve/CVE-2026-11460nvd
vuldb.com/submit/814455nvd
vuldb.com/vuln/369080nvd
vuldb.com/vuln/369080/ctinvd

News mentions

No linked articles in our index yet.

cvss	0.474
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000