CVE-2026-33666 Zserio: Integer Overflow in BitStreamReader on 32-bit platforms
An integer overflow in Zserio's BitStreamReader allows attackers to cause a segmentation fault and denial of service on 32-bit platforms.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-33666?
CVE-2026-33666 is a high-severity vulnerability in ndsev zserio, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, in BitStreamReader.h readBytes() / readString(), the setBitPosition() bounds check receives the overflowed value and is completely bypassed. The code then reads len bytes (512 MB) from a buffer that is only a few bytes long, causing a segmentation fault. This vulnerability is fixed in 2.18.1.
Weakness: CWE-190
Which versions are affected by CVE-2026-33666?
It affects 1 product.
Products include Nds-Association Zserio.
How do I fix CVE-2026-33666?
No fix has been published for CVE-2026-33666 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-33666 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33666 exists.
Other vulnerabilities in ndsev zserio
Sources
Also known as GHSA-fjwv-6wcr-vqwj.