Re: CVE-2026-11460 - security flaw in serialization

On Tue, Jun 23, 2026 at 9:14 AM Robert Ramey via Boost <
[email protected]> wrote:

> On 6/23/26 2:23 AM, Joaquin M López Muñoz via Boost wrote:
>
> > 100% agree. The only security-related requirement we should put on
> > Boost.Serialization, and we should put it, is that no UB be generated on
> > archive loading time.
> >
> > Joaquín M López Muñoz
>
> I believe that there is no possible undefined for loading archives which
> have been saved in the same format as that loaded.  The only scenario I
> could think of where this could occur would be:
>
> a) There is an error in the usage of the library in that the user code
> implementing the "saving" of an archive is not consistent with the code
> implementing the "loading" of tthat archive.
>
> b) The archive being loaded has been altered from the origainally saved
> one.  (I called this tampering).
>

Yes, this is exactly the aforementioned precondition that shouldn't exist
in a library such as Serialization.

We should have no preconditions. The library should exhibit no UB for all
possible inputs.

We should petition the Alliance to set up fuzzing for security-critical
libraries like Serialization.

- Christian
_______________________________________________
Boost mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://lists.boost.org/mailman3/lists/boost.lists.boost.org/
Archived at: https://lists.boost.org/archives/list/[email protected]/message/MSSY3IJNV66ORCC2VAANUFZZQWBKGKHM/