Re: CVE-2026-11460 - security flaw in serialization

On 23 Jun 2026 18:55, Robert Ramey via Boost wrote:
> On 6/23/26 2:23 AM, Joaquin M López Muñoz via Boost wrote:
> 
> I believe that there is no possible undefined for loading archives which
> have been saved in the same format as that loaded.  The only scenario I
> could think of where this could occur would be:
> 
> a) There is an error in the usage of the library in that the user code
> implementing the "saving" of an archive is not consistent with the code
> implementing the "loading" of tthat archive.

Could a) be the case, for example, if the archive being loaded was saved
by an older or different version of the program? In particular, if the
set of data or types of data that was saved into the archive is
different from what is expected by the loader? Does Boost.Serialization
report an error in this case? Is the loader application able to tell
that this mismatch has happened?

_______________________________________________
Boost mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://lists.boost.org/mailman3/lists/boost.lists.boost.org/
Archived at: https://lists.boost.org/archives/list/[email protected]/message/SH3XR22NWW5WGJAJN2N6CP3FVOZBFSJZ/