CVE-2025-60887
Gravedad CVSS v3.1:
MEDIA
Tipo:
CWE-502
Deserialización de datos no confiables
Fecha de publicación:
28/04/2026
Última modificación:
28/04/2026
Descripción
*** Pendiente de traducción *** An issue was discovered in Cista v0.15 and below. Insecure deserialization of untrusted input under certain conditions may lead to leaking of stack/heap addresses which may be used to bypass ASLR. Classes with pointer-like mechanics under the cista::raw namespace are prone to reference tampering, where Cista does not perform sufficient checks to safeguard against self-referencing pointers and referencing other data within the payload. The leak occurs if the deserialized values are observable by the attacker.
Impacto
Puntuación base 3.x
5.30
Gravedad 3.x
MEDIA