This vulnerability in Boost Serialization up to version 1.91 allows remote attackers to exploit improper validation of input types during serialization processes. The flaw resides in an unspecified function within the library, enabling manipulation of input data types without proper checks. The maintainer was notified in August 2025 but has not provided a fix, and the disclosure deadline has passed. The CVSS 4.0 base score is 6.3, indicating a medium severity with network attack vector, low complexity, no privileges required, no user interaction, and partial impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to partial compromise of confidentiality, integrity, and availability of applications using the affected Boost Serialization versions. Since the vulnerability can be triggered remotely without authentication, it poses a risk to exposed services or applications that deserialize untrusted data. However, the impact is limited to partial loss rather than complete system compromise.

No official patch or fix is currently available as the maintainer has postponed remediation indefinitely. Users should avoid deserializing untrusted or unauthenticated data with affected Boost Serialization versions. Monitor vendor advisories for any future updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.