CVE-2026-33666

Published: Apr 24, 2026Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, in BitStreamReader.h readBytes() / readString(), the setBitPosition() bounds check receives the overflowed value and is completely bypassed. The code then reads len bytes (512 MB) from a buffer that is only a few bytes long, causing a segmentation fault. This vulnerability is fixed in 2.18.1.

Affected (1)

Products: Nds Association: Zserio

Nds Association

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nds Association Zserio	Before 2.18.1

Related CWEs

Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

References (2)

https://github.com/ndsev/zserio/security/advisories/GHSA-fjwv-6wcr-vqwj

Source: security-advisories@github.com

ExploitMitigationVendor Advisory

https://github.com/ndsev/zserio/security/advisories/GHSA-fjwv-6wcr-vqwj

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitMitigationVendor Advisory

Timeline

No history available yet.