What’s Vulnerable › Vulnerabilities

CVE-2025-60887

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-28 · updated 2026-07-05
• Weakness: CWE-502

Description

An issue was discovered in Cista v0.15 and below. Insecure deserialization of untrusted input under certain conditions may lead to leaking of stack/heap addresses which may be used to bypass ASLR. Classes with pointer-like mechanics under the cista::raw namespace are prone to reference tampering, where Cista does not perform sufficient checks to safeguard against self-referencing pointers and referencing other data within the payload. The leak occurs if the deserialized values are observable by the attacker.

References

• https://gist.github.com/TrebledJ/66cc0ed37bdb3e70ce0ef98396790771
• https://gist.github.com/TrebledJ/66cc0ed37bdb3e70ce0ef98396790771

Get alerted when CVE-2025-60887 or the next vulnerability affects your stack