CVE-2026-33666

Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, in BitStreamReader.h readBytes() / readString(), the setBitPosition() bounds check receives the overflowed value and is completely bypassed. The code then reads len bytes (512 MB) from a buffer that is only a few bytes long, causing a segmentation fault. This vulnerability is fixed in 2.18.1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ndsev/zserio/security/advisories/GHSA-fjwv-6wcr-vqwj	Exploit Mitigation Vendor Advisory
https://github.com/ndsev/zserio/security/advisories/GHSA-fjwv-6wcr-vqwj	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nds-association:zserio:*:*:*:*:*:*:*:*

History

26 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) Zserio es un framework para serializar datos estructurados de una manera compacta y eficiente con baja sobrecarga. Antes de la versión 2.18.1, en BitStreamReader.h readBytes() / readString(), la comprobación de límites de setBitPosition() recibe el valor desbordado y es completamente eludida. El código luego lee len bytes (512 MB) de un búfer que tiene solo unos pocos bytes de longitud, causando un fallo de segmentación. Esta vulnerabilidad está corregida en la versión 2.18.1.

Information

Published : 2026-04-24 19:17

Updated : 2026-10-26 00:10

NVD link : CVE-2026-33666

Mitre link : CVE-2026-33666

CVE.ORG link : CVE-2026-33666

JSON object : View

Products Affected

nds-association

zserio

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2026-33666", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33666", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T13:45:58.519906Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ndsev", "product": "zserio", "versions": [{"status": "affected", "version": "<= 2.15.0"}]}]}], "published": "2026-04-24T19:17:10.147", "references": [{"url": "https://github.com/ndsev/zserio/security/advisories/GHSA-fjwv-6wcr-vqwj", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ndsev/zserio/security/advisories/GHSA-fjwv-6wcr-vqwj", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, in BitStreamReader.h readBytes() / readString(), the setBitPosition() bounds check receives the overflowed value and is completely bypassed. The code then reads len bytes (512 MB) from a buffer that is only a few bytes long, causing a segmentation fault. This vulnerability is fixed in 2.18.1."}, {"lang": "es", "value": "Zserio es un framework para serializar datos estructurados de una manera compacta y eficiente con baja sobrecarga. Antes de la versi\u00f3n 2.18.1, en BitStreamReader.h readBytes() / readString(), la comprobaci\u00f3n de l\u00edmites de setBitPosition() recibe el valor desbordado y es completamente eludida. El c\u00f3digo luego lee len bytes (512 MB) de un b\u00fafer que tiene solo unos pocos bytes de longitud, causando un fallo de segmentaci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.18.1."}], "lastModified": "2026-10-26T00:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nds-association:zserio:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5488B9D1-04B2-459B-BE23-2FF4A91D12CF", "versionEndExcluding": "2.18.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}