CVE-2026-33524 — Zserio: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization

CVE-2026-33524

Zserio: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization PUBLISHED

Description (CNA)

Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, a crafted payload as small as 4-5 bytes can force memory allocations of up to 16 GB, crashing any process with an OOM error (Denial of Service). This vulnerability is fixed in 2.18.1.

Affected (CNA)

Vendor / product	Versions
ndsev / zserio	affected < 2.18.1

CWE

CWE-789

References

https://github.com/ndsev/zserio/security/advisories/GHSA-cwq5-8pvq-j65j

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.