A vulnerability marked as critical has been reported in Boost Serialization up to 1.91. The impacted element is an unknown function. This manipulation causes improper validation of specified type of input.
The identification of this vulnerability is CVE-2026-11460. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.
The maintainer was notified on Aug 2025 and a disclosure deadline was set for 90 days. The maintainer acknowledged but postponed indefinitely citing time concerns. No patch is currently available and the disclosure deadline has expired.
