CVE-2026-33524CWE-789

Zserio: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization

High · published April 24, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
40.9
In the wild
Unconfirmed
What it is

Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, a crafted payload as small as 4-5 bytes can force memory allocations of up to 16 GB, crashing any process with an OOM error (Denial of Service). This vulnerability is fixed in 2.18.1.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00486 · 40.9th percentile
Weakness
CWE-789 · Memory Allocation with Excessive Size Value
Published
2026-04-24T18:18Z
EPSS history
Timeline
  • 24 APR 18:18Z
    Zserio: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization
    cvelistv5