Insecure Serialization/Deserialization

Serialization: object state to byte stream, i.e. something in RAM being saved to disk.
Deserialization: byte stream to object state, as in something being loaded from a file and then being put into RAM.

I've vaguely heard of attacks relating to serialization/deserialization. Do you know anything about them?

Possible with a vulnerable serializer.

>>2
What makes a serializer vulnerable?

A vulnerability in the code.

>>4
gee, thanks, genius

GPUs having DMA. Good times, good times.

>>6
How is that relevant?

>>7
Hmm, let's see... a separate processor with direct RAM access. Nope, totally irrelevant.

>>8
ok buddy but you still need to load stuff to and from files (or network sessions, because those can provide byte streams too), not everything is stored in RAM forever, it's volatile
and a lot of server-related deserialization stuff has nothing to do with GPUs