Executive brief
StellarGroup HPX is a C++ standard library for parallelism and concurrency used in high-performance computing. A security flaw in how the library handles data received from external sources allows an attacker to send specially crafted information that the system incorrectly processes. This can lead to unauthorized access to sensitive memory, system crashes, or the ability for an attacker to take full control of the affected server or network node.
Technical details
An insecure deserialization vulnerability exists in StellarGroup HPX v1.11.0 and earlier within the `serialize_pointer_tracked` function in `libs/core/serialization/include/hpx/serialization/detail/pointer.hpp`. The root cause is insufficient type checking when deserializing shared references, which allows an attacker to cause type confusion by making a shared pointer of one type refer to an object of a different type. By crafting a malicious serialized payload, a remote attacker can achieve information disclosure (such as ASLR bypass via address leaks), arbitrary memory reads, or control flow hijacking (via vtable hijacking). This can ultimately lead to arbitrary code execution or local privilege escalation depending on how the serialization is exposed.
Affected products
- StellarGroup HPX 1.11.0 and below
Timeline
- 2026-04-28: advisory: Initial disclosure of CVE-2025-60889