Vulnerability Description
Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, in BitStreamReader.h readBytes() / readString(), the setBitPosition() bounds check receives the overflowed value and is completely bypassed. The code then reads len bytes (512 MB) from a buffer that is only a few bytes long, causing a segmentation fault. This vulnerability is fixed in 2.18.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nds-Association | Zserio | < 2.18.1 |
Related Weaknesses (CWE)
References
- https://github.com/ndsev/zserio/security/advisories/GHSA-fjwv-6wcr-vqwjExploitMitigationVendor Advisory
- https://github.com/ndsev/zserio/security/advisories/GHSA-fjwv-6wcr-vqwjExploitMitigationVendor Advisory
FAQ
What is CVE-2026-33666?
CVE-2026-33666 is a vulnerability with a CVSS score of 7.5 (HIGH). Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, in BitStreamReader.h readBytes() / readString(), the setBitPosition() bounds ...
How severe is CVE-2026-33666?
CVE-2026-33666 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-33666?
Check the references section above for vendor advisories and patch information. Affected products include: Nds-Association Zserio.