Executive brief
USCiLab Cereal is a popular C++ library used by developers to save and load data structures (serialization). A security flaw in how the library handles shared pointers allows an attacker to provide a specially crafted data file that tricks the application into misinterpreting data types. This can lead to sensitive information leaks, application crashes, or potentially allow an attacker to take full control of the affected system.
Technical details
A type confusion vulnerability exists in USCiLab Cereal versions up to and including 1.3.2 within the Shared Pointer Handler component. The flaw is rooted in insecure deserialization where the library fails to properly validate that a shared reference being loaded matches the expected type of the object it is being assigned to. By manipulating the 'id' fields in serialized XML or JSON archives, a remote attacker can force two different pointer types to point to the same memory address. This can be exploited to leak heap/vtable addresses or hijack v-pointers to achieve arbitrary code execution. The vulnerability can be triggered remotely if the application processes untrusted serialized data.
Affected products
- USCiLab Cereal up to 1.3.2
Timeline
- 2025-08-08: disclosed: Initial discovery and issue reported on GitHub
- 2026-06-07: advisory: CVE-2026-11463 published