Is CVE-2020-11105 actively exploited?

No active exploitation of CVE-2020-11105 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2020-11105 be exploited remotely?

Yes. CVE-2020-11105 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2020-11105?

CVE-2020-11105 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2020-11105

CRITICAL

CVE-2020-11105

CWE-763Published: March 30, 2020· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

An issue was discovered in USC iLab cereal through 1.3.0. It employs caching of std::shared_ptr values, using the raw pointer address as a unique identifier. This becomes problematic if an std::shared_ptr variable goes out of scope and is freed, and a new std::shared_ptr is allocated at the same address. Serialization fidelity thereby becomes dependent upon memory layout. In short, serialized std::shared_ptr variables cannot always be expected to serialize back into their original values. This can have any number of consequences, depending on the context within which this manifests.

NVD Source

Technical Analysis

CVE-2020-11105 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.