CVE-2026-33666: Zserio: Integer Overflow in BitStreamReader on 32-bit platforms

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-24 · updated 2026-10-26
Weakness: CWE-190

Description

Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, in BitStreamReader.h readBytes() / readString(), the setBitPosition() bounds check receives the overflowed value and is completely bypassed. The code then reads len bytes (512 MB) from a buffer that is only a few bytes long, causing a segmentation fault. This vulnerability is fixed in 2.18.1.

Affected products

ndsev zserio: before 2.18.1 — fixed in 2.18.1

How to fix

Upgrade to a fixed version: ndsev zserio 2.18.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-33666 or the next vulnerability affects your stack