A flaw in Boost Serialization up to version 1.91 causes improper validation of the specified type of input. When a deserialization operation processes data that has not been correctly validated, an attacker could introduce crafted serialized payloads that may manipulate the internal behavior of the library. The impact is not explicitly defined in the CVE description, but the presence of an available exploit indicates that the vulnerability can result in unintended execution of code or other damaging actions depending on how the data is handled by the application.

All installations of Boost Serialization through version 1.91 are vulnerable. The issue is tied to the library as a whole rather than to a specific component, so any application that performs deserialization of data using Boost Serialization in this version range is at risk.

The CVSS score of 6.3 reflects moderate severity, and while no EPSS score is available, the exploit has already been published, underscoring the potential for exploitation. The vulnerability is not listed in the CISA KEV catalog, but the lack of a patch and the remote nature of the attack mean that a threat actor could target exposed services that perform deserialization. The principal risk is the continued exposure of systems that process untrusted serialized input without applying the necessary validation controls.