CVE-2025-60887 | BDVDB-2026-329329 Detail

Description#

An issue was discovered in Cista v0.15 and below. Insecure deserialization of untrusted input under certain conditions may lead to leaking of stack/heap addresses which may be used to bypass ASLR. Classes with pointer-like mechanics under the cista::raw namespace are prone to reference tampering, where Cista does not perform sufficient checks to safeguard against self-referencing pointers and referencing other data within the payload. The leak occurs if the deserialized values are observable by the attacker.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-04-28Record published in the CVE List.
2. Version 22026-07-05Most recent update recorded in the CVE List.