Executive brief
Boost Serialization is a widely used C++ library that allows developers to save and restore program data. A security flaw in this library allows an attacker to provide specially crafted data that tricks the software into misinterpreting memory. This can lead to serious consequences, including the theft of sensitive information, system crashes, or the ability for an attacker to take full control of the affected application.
Technical details
Boost Serialization (up to v1.91) is vulnerable to insecure deserialization. The library's pointer tracking mechanism can be manipulated via crafted archives (XML, text, or binary) to force multiple deserialized objects to share the same memory address. This root cause leads to Type Confusion (e.g., treating a string buffer address as an integer) and Ownership Confusion (e.g., violating unique_ptr constraints). An attacker can exploit these primitives to achieve address leakage, arbitrary memory reads, VTable hijacking, or double-free conditions. While the maintainer was notified in August 2025, no official patch is currently available, and the vulnerability can be triggered remotely if the application deserializes untrusted data.
Affected products
- Boost Serialization up to 1.91
Timeline
- 2025-08-08: disclosed: Initial report to maintainers via GitHub issue
- 2025-08-27: other: Detailed technical write-up created by researcher
- 2026-06-07: advisory: Public disclosure of CVE-2026-11460