Executive brief
Cista is a C++ library used for high-performance data serialization and deserialization. A security flaw in how it handles untrusted data allows an attacker to craft a malicious payload that reveals internal memory addresses (stack or heap) of the application. This information can be used by attackers to bypass critical security protections like Address Space Layout Randomization (ASLR), making it easier to launch more complex and damaging attacks against the system.
Technical details
An insecure deserialization vulnerability exists in Cista v0.15 and below within the cista::raw namespace. The library fails to perform sufficient validation on pointer-like mechanics, specifically regarding self-referencing pointers and offsets within a serialized payload. By crafting a payload with manipulated offsets (e.g., setting a pointer offset to zero), an attacker can cause the deserialized object to point to its own memory location or other arbitrary data within the payload. If the application subsequently makes these deserialized values observable (e.g., via logs, UI, or network responses), the attacker can leak stack or heap addresses. This primitive allows for the bypass of Address Space Layout Randomization (ASLR) and Position Independent Executables (PIE).
Affected products
- Cista Cista <= 0.15
Timeline
- 2025-08-27: other: Vulnerability discovered/documented by researcher
- 2026-04-28: disclosed: Public disclosure of CVE-2025-60887