---
id: CVE-2026-11460
title: Boost Serialization improper validation of specified type of input
summary: >-
  A flaw has been found in Boost Serialization. The impacted element is an
  unknown function. This manipulation causes improper validation of specified
  type of input. It is possible to initiate the attack remotely. The exploit has
  been publ…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'
cvssSource: cna
cwe:
  - CWE-1287
  - CWE-20
vendor: Boost
product: Serialization
affected:
  - Serialization 1.32.0
  - Serialization 1.33.0
  - Serialization 1.33.1
  - Serialization 1.34.0
  - Serialization 1.34.1
  - Serialization 1.35.0
  - Serialization 1.36.0
  - Serialization 1.37.0
  - Serialization 1.38.0
  - Serialization 1.39.0
  - Serialization 1.40.0
  - Serialization 1.41.0
  - Serialization 1.42.0
  - Serialization 1.43.0
  - Serialization 1.44.0
  - Serialization 1.45.0
  - Serialization 1.46.0
  - Serialization 1.46.1
  - Serialization 1.47.0
  - Serialization 1.48.0
  - Serialization 1.49.0
  - Serialization 1.50.0
  - Serialization 1.51.0
  - Serialization 1.52.0
  - Serialization 1.53.0
  - Serialization 1.54.0
  - Serialization 1.55.0
  - Serialization 1.56.0
  - Serialization 1.57.0
  - Serialization 1.58.0
  - Serialization 1.59.0
  - Serialization 1.60.0
  - Serialization 1.61.0
  - Serialization 1.62.0
  - Serialization 1.63.0
  - Serialization 1.64.0
  - Serialization 1.65.0
  - Serialization 1.65.1
  - Serialization 1.66.0
  - Serialization 1.67.0
  - Serialization 1.68.0
  - Serialization 1.69.0
  - Serialization 1.70.0
  - Serialization 1.71.0
  - Serialization 1.72.0
  - Serialization 1.73.0
  - Serialization 1.74.0
  - Serialization 1.75.0
  - Serialization 1.76.0
  - Serialization 1.77.0
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-06-08T13:45:37.162774Z'
exploitAvailable: true
published: '2026-06-07'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T20:32:46.400Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-11460'
references:
  - url: 'https://vuldb.com/vuln/369080'
    label: >-
      VDB-369080 | Boost Serialization improper validation of specified type of
      input
  - url: 'https://vuldb.com/vuln/369080/cti'
    label: 'VDB-369080 | CTI Indicators (IOB, IOC)'
  - url: 'https://vuldb.com/cve/CVE-2026-11460'
    label: CVE-2026-11460 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/814455'
    label: >-
      Submit #814455 | boostorg boost serialization 1.91 CWE-1287, CWE-843 (Type
      Confusion)
  - url: 'https://github.com/boostorg/serialization/issues/331'
  - url: 'https://gist.github.com/TrebledJ/b7c872f869b5ed7cbd936f71f16c7d75'
tags:
  - cve.org
  - exploit-available
epss: 0.00311
epssPercentile: 0.24109
ingestedAt: '2026-11-05T19:30:42.837Z'
---

## Overview

A flaw has been found in Boost Serialization. The impacted element is an unknown function. This manipulation causes improper validation of specified type of input. It is possible to initiate the attack remotely. The exploit has been published and may be used. The maintainer was notified on Aug 2025 and a disclosure deadline was set for 90 days. The maintainer acknowledged but postponed indefinitely citing time concerns. No patch is currently available and the disclosure deadline has expired.

## Affected

- `Serialization 1.32.0`
- `Serialization 1.33.0`
- `Serialization 1.33.1`
- `Serialization 1.34.0`
- `Serialization 1.34.1`
- `Serialization 1.35.0`
- `Serialization 1.36.0`
- `Serialization 1.37.0`
- `Serialization 1.38.0`
- `Serialization 1.39.0`
- `Serialization 1.40.0`
- `Serialization 1.41.0`
- `Serialization 1.42.0`
- `Serialization 1.43.0`
- `Serialization 1.44.0`
- `Serialization 1.45.0`
- `Serialization 1.46.0`
- `Serialization 1.46.1`
- `Serialization 1.47.0`
- `Serialization 1.48.0`
- `Serialization 1.49.0`
- `Serialization 1.50.0`
- `Serialization 1.51.0`
- `Serialization 1.52.0`
- `Serialization 1.53.0`
- `Serialization 1.54.0`
- `Serialization 1.55.0`
- `Serialization 1.56.0`
- `Serialization 1.57.0`
- `Serialization 1.58.0`
- `Serialization 1.59.0`
- `Serialization 1.60.0`
- `Serialization 1.61.0`
- `Serialization 1.62.0`
- `Serialization 1.63.0`
- `Serialization 1.64.0`
- `Serialization 1.65.0`
- `Serialization 1.65.1`
- `Serialization 1.66.0`
- `Serialization 1.67.0`
- `Serialization 1.68.0`
- `Serialization 1.69.0`
- `Serialization 1.70.0`
- `Serialization 1.71.0`
- `Serialization 1.72.0`
- `Serialization 1.73.0`
- `Serialization 1.74.0`
- `Serialization 1.75.0`
- `Serialization 1.76.0`
- `Serialization 1.77.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.