INC-20261108-3B15

Actively exploited deserialization flaw in libsignalproc as bundled · high · aware 2026-11-08 10:13:57 UTC

Report (PDF) Edit

CRA — actively exploited vulnerability

Regulation (EU) 2024/2847, Article 14
  • Early warningArticle 14(2)(a)
    Submitted late
    filed 2026-11-09 18:13:57 UTC

    Without undue delay and in any event within 24 hours of becoming aware.

  • Vulnerability notificationArticle 14(2)(b)
    Overdue
    2d 0h ago due 2026-11-11 10:13:57 UTC

    Within 72 hours of becoming aware of the actively exploited vulnerability. · Draft it

  • Final reportArticle 14(2)(c)
    Not started
    — starts on a corrective or mitigating measure being available

    No later than 14 days after a corrective or mitigating measure is available. The clock does not start until that measure exists. · Draft it

Record a notification for CRA — actively exploited vulnerability
The real moment it went out. The one-month final-report clock runs from this.

What was actually sent

1
Submitted (UTC)RegimeStageToRef
2026-11-09 18:13 CRA early CRA single reporting platformPortal CRA-2026-4402

Evidence

0 files

Nothing attached. Screenshots of the portal acknowledgment, the sent notification, and the technical analysis live here.

PDF, PNG, JPEG or WebP, up to 10 MB. The file itself has to be one of those — the name is not enough.
×
Live demo — signed in as the admin, sample data resets hourly.
Own it — one payment →