CVE-2026-33524 Zserio: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization
A crafted payload triggers an integer overflow leading to unbounded memory allocation and process crash in the Zserio library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33524?
CVE-2026-33524 is a high-severity vulnerability in ndsev zserio, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, a crafted payload as small as 4-5 bytes can force memory allocations of up to 16 GB, crashing any process with an OOM error (Denial of Service). This vulnerability is fixed in 2.18.1.
Weakness: CWE-789
Which versions are affected by CVE-2026-33524?
2 open source packages ship an affected version, including io.github.ndsev:zserio-runtime. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.github.ndsev:zserio-runtime Maven | All versions | 2.18.1 |
io.github.ndsev:zserio-runtime Maven | All versions | 2.18.1 |
Products include Nds-Association Zserio.
How do I fix CVE-2026-33524?
Upgrade io.github.ndsev:zserio-runtime to 2.18.1 or later.
Is CVE-2026-33524 being exploited?
There is no known exploitation of CVE-2026-33524 in the wild and no public exploit code.
Other vulnerabilities in ndsev zserio
Sources
Also known as GHSA-cwq5-8pvq-j65j.