CVE-2026-33524 HIGH

CVE-2026-33524: Zserio: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization

Vendor Ndsev
Product zserio
Weakness CWE-789
Published April 24, 2026
Last update April 27, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, a crafted payload as small as 4-5 bytes can force memory allocations of up to 16 GB, crashing any process with an OOM error (Denial of Service). This vulnerability is fixed in 2.18.1.

Key dates

02Disclosure timeline

April 24, 2026 CVE published
April 27, 2026 Record updated