CVE-2026-33524

Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, a crafted payload as small as 4-5 bytes can force memory allocations of up to 16 GB, crashing any process with an OOM error (Denial of Service). This vulnerability is fixed in 2.18.1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ndsev/zserio/security/advisories/GHSA-cwq5-8pvq-j65j	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nds-association:zserio:*:*:*:*:*:*:*:*

History

26 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) Zserio es un framework para serializar datos estructurados de forma compacta y eficiente con baja sobrecarga. Antes de 2.18.1, una carga útil manipulada de tan solo 4-5 bytes puede forzar asignaciones de memoria de hasta 16 GB, provocando la caída de cualquier proceso con un error OOM (Denegación de servicio). Esta vulnerabilidad está corregida en 2.18.1.

Information

Published : 2026-04-24 19:17

Updated : 2026-10-26 00:10

NVD link : CVE-2026-33524

Mitre link : CVE-2026-33524

CVE.ORG link : CVE-2026-33524

JSON object : View

Products Affected

nds-association

zserio

CWE

CWE-789

Memory Allocation with Excessive Size Value

{"id": "CVE-2026-33524", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33524", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T13:20:21.391216Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ndsev", "product": "zserio", "versions": [{"status": "affected", "version": "< 2.18.1"}]}]}], "published": "2026-04-24T19:17:09.850", "references": [{"url": "https://github.com/ndsev/zserio/security/advisories/GHSA-cwq5-8pvq-j65j", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-789"}]}], "descriptions": [{"lang": "en", "value": "Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, a crafted payload as small as 4-5 bytes can force memory allocations of up to 16 GB, crashing any process with an OOM error (Denial of Service). This vulnerability is fixed in 2.18.1."}, {"lang": "es", "value": "Zserio es un framework para serializar datos estructurados de forma compacta y eficiente con baja sobrecarga. Antes de 2.18.1, una carga \u00fatil manipulada de tan solo 4-5 bytes puede forzar asignaciones de memoria de hasta 16 GB, provocando la ca\u00edda de cualquier proceso con un error OOM (Denegaci\u00f3n de servicio). Esta vulnerabilidad est\u00e1 corregida en 2.18.1."}], "lastModified": "2026-10-26T00:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nds-association:zserio:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5488B9D1-04B2-459B-BE23-2FF4A91D12CF", "versionEndExcluding": "2.18.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}