CVE-2026-11460: Boost Serialization RCE Vulnerability

CVE-2026-11460 Overview

CVE-2026-11460 is an improper input validation flaw [CWE-20] affecting Boost Serialization versions up to 1.91. The vulnerability resides in an unspecified function that fails to properly validate the type of input it processes. A remote attacker can trigger the flaw by supplying crafted serialized data to an application that uses the affected library. A proof-of-concept exploit has been published publicly. The Boost maintainers were notified in August 2025 and acknowledged the report but postponed remediation indefinitely. No patch is currently available, and the 90-day coordinated disclosure deadline has expired.

Critical Impact
Remote attackers can submit malformed serialized input to applications linking against vulnerable Boost Serialization builds, potentially producing limited confidentiality, integrity, and availability impact. No vendor fix exists.

Affected Products

Boost Serialization versions up to and including 1.91
Applications and services statically or dynamically linked against vulnerable Boost Serialization builds
Downstream C++ projects that consume untrusted serialized streams via Boost

Discovery Timeline

Aug 2025 - Maintainer notified of the vulnerability with a 90-day disclosure deadline
2026-06-07 - CVE-2026-11460 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11460

Vulnerability Analysis

The vulnerability is classified as Improper Input Validation [CWE-20] within Boost Serialization. The affected component fails to verify that an incoming serialized stream matches the type signature expected by the deserialization routine. When the library reconstructs an object graph from untrusted bytes, type metadata is consumed without strict validation against the declared receiver type.

Boost Serialization is widely used in C++ applications for persisting and transmitting object state. Because the flaw sits inside a general-purpose deserialization path, the impact depends heavily on how consuming applications expose serialized input to attackers. Network-facing services that accept Boost archives over sockets, message queues, or files are the primary risk surface.

A public proof-of-concept has been published on GitHub Gist, demonstrating that the issue is practically reachable. According to the EPSS forecast dated 2026-06-11, the probability of observed exploitation remains low.

Root Cause

The root cause is missing or insufficient validation of the specified input type during deserialization. The library trusts type identifiers embedded in the serialized stream rather than enforcing them against the declared C++ type at the call site. This permits crafted archives to drive the deserializer into states the application author did not anticipate.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction, though exploitation depends on an attacker-controlled precondition such as the ability to deliver a crafted serialized payload. An attacker submits a malformed Boost archive to an endpoint that calls into the affected serialization routine. Successful exploitation yields limited impact across confidentiality, integrity, and availability of the consuming process.

No verified exploit code is reproduced here. The published proof-of-concept is available in the referenced GitHub Gist PoC and the upstream GitHub Issue Discussion.

Detection Methods for CVE-2026-11460

Indicators of Compromise

Unexpected exceptions, aborts, or crashes originating from boost::archive deserialization frames in application logs
Inbound network payloads matching Boost binary or XML archive magic headers from untrusted sources
Repeated malformed serialized requests targeting endpoints that accept C++ object streams

Detection Strategies

Inventory all binaries linked against Boost Serialization 1.91 or earlier using software composition analysis tooling
Instrument deserialization entry points with structured logging that records archive type, size, and source identity
Apply runtime behavioral monitoring to flag anomalous child processes, memory faults, or resource spikes following deserialization calls

Monitoring Recommendations

Forward application and crash telemetry to a centralized analytics platform for correlation across hosts
Alert on stack traces that include Boost serialization symbols paired with SIGABRT, SIGSEGV, or unhandled C++ exceptions
Track network flows to services known to accept serialized C++ objects and baseline normal payload structures

How to Mitigate CVE-2026-11460

Immediate Actions Required

Treat all Boost serialized input from untrusted sources as hostile and reject it at the application boundary
Restrict network exposure of services that deserialize Boost archives to authenticated, internal callers only
Audit code paths that invoke boost::archive::binary_iarchive, text_iarchive, or xml_iarchive against external data

Patch Information

No patch is currently available. The Boost maintainers acknowledged the report but postponed remediation indefinitely, citing time constraints. Monitor the upstream GitHub Issue Discussion and the VulDB CVE-2026-11460 entry for updates. Until a fix lands, treat affected components as end-of-support for security purposes.

Workarounds

Wrap Boost deserialization calls in strict input validators that enforce maximum size, expected archive flavor, and schema constraints before invoking the library
Add authenticated transport, message authentication codes, or signatures so only trusted producers can submit archives
Migrate untrusted data handling to a serialization format with stronger type safety such as Protocol Buffers, FlatBuffers, or Cap'n Proto
Isolate processes that must deserialize untrusted Boost archives inside sandboxes, containers, or seccomp profiles to contain impact

bash

# Example seccomp/AppArmor-style isolation pattern for a service that must accept Boost archives
# Run the deserializer in a dedicated low-privilege user namespace
systemd-run --uid=boost-deser --gid=boost-deser \
  --property=NoNewPrivileges=yes \
  --property=PrivateTmp=yes \
  --property=ProtectSystem=strict \
  --property=MemoryMax=256M \
  /usr/local/bin/deserializer-worker