CVE-2012-2677: Integer overflow in the ordered_malloc function in boost/pool/pool.hpp in Boost Pool before 3.9 makes it ea...

Security readout for executives and security teams

This is an old Boost Pool allocator flaw where an extremely large requested chunk size could make the allocator reserve less memory than expected. In software that exposes that path to attacker-controlled input, the result could support memory-corruption attacks such as buffer overflows. Exposure is most likely in C++ applications or packaged software that used vulnerable Boost Pool code and accepted attacker-influenced allocation sizes. The bundle lists distro advisories but does not enumerate specific affected applications or supported product versions. Treat this as a targeted dependency hygiene issue, not an internet-wide emergency based on the supplied evidence. Prioritize systems with exposed C++ services, bundled legacy Boost code, or unsupported Linux packages. Mitigation focus: Inventory software that embeds or packages Boost Pool before 3.9.; Review Boost changeset 78326 and vendor advisories for update guidance.; Apply applicable vendor or distribution security updates..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.