PT-2026-43178 · Bitsery · Bitsery

Trebledj · CVE-2026-9521 · Published 2026-05-26 · Updated 2026-05-26

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions fraillt bitsery versions prior to 5.2.5

Description Improper validation of the specified type of input occurs within the loadFromSharedState() function located in the include/bitsery/ext/std smart ptr.h library. This issue allows for a remote attack.

Recommendations Update to version 5.2.5. As a temporary workaround, restrict the use of the loadFromSharedState() function until the update is applied.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

CWE-1287

Related Identifiers

CVE-2026-9521

Affected Products

Bitsery

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9521.json · Exploit
• 🔥 https://gist.github.com/TrebledJ/750abc64a826f19dd2d6774724629b71 · Exploit
• https://github.com/fraillt/bitsery/commit/66d16516e24893bebc1c8af52bf2fe9ad0735061 · Patch
• https://github.com/fraillt/bitsery/releases/tag/v5.2.5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-9521 · Security Note
• https://osv.dev/vulnerability/CVE-2026-9521 · Vendor Advisory
• https://github.com/fraillt/bitsery/blob/master/CHANGELOG.md#525-2025-10-09 · Note
• https://vuldb.com/vuln/365541 · Note
• https://vuldb.com/vuln/365541/cti · Note
• https://t.me/CVEtracker/54945 · Telegram Post
• https://vuldb.com/submit/814457 · Note
• https://github.com/fraillt/bitsery · Note