Draft · INC-20261108-3B15 · Kestrel Systems GmbH (Demo)

Built from the incident record, under headings that follow what the provision asks for. Yours to check, complete and send through the authority's own form or portal; Cyresora files nothing.

2 items to complete — the record does not hold what is known about the actor, or "none known"; the update or measure and when it was made available. Each is marked [to complete: …] in the text.

Final report — INC-20261108-3B15 — Actively exploited deserialization flaw in libsignalproc as bundled

DRAFT: Final report under CRA — actively exploited vulnerability
Regulation (EU) 2024/2847, Article 14, Article 14(2)(c).
Prepared by Cyresora from incident INC-20261108-3B15. Yours to check and edit before you send it; Cyresora files nothing.

To: CRA single reporting platform

1. Reporting organization
Kestrel Systems GmbH (Demo)
Contact: security@kestrel.example

2. Incident
Actively exploited deserialization flaw in libsignalproc as bundled
Our reference: INC-20261108-3B15
Became aware: 2026-11-08 10:37:02 UTC (2026-11-08 11:37 CET)
Severity (our assessment): high

3. Description of the vulnerability, its severity and impact (Article 14(2)(c))
CVE-2026-30112 Deserialization flaw in bundled libsignalproc (severity high)

4. Information on any malicious actor exploiting it, where available (Article 14(2)(c))
[to complete: what is known about the actor, or "none known"]

5. Security update or other corrective measures made available (Article 14(2)(c))
[to complete: the update or measure and when it was made available]

6. Earlier submissions under this regime
Early warning: submitted 2026-11-09 18:37:02 UTC, their reference CRA-2026-4402

When you have sent it

Record it here with what you actually sent (edit the text above to match). That record stops this stage's clock.

Submitted at (Europe/Berlin)

Channel

Their reference

Draft: Final report

Final report — INC-20261108-3B15 — Actively exploited deserialization flaw in libsignalproc as bundled

When you have sent it