Buffer Overflow Vulnerability in Zserio Framework by ndsev

CVE-2026-33666

What is CVE-2026-33666?

The Zserio Framework, a tool designed for efficient serialization of structured data, contains a buffer overflow vulnerability in its 'readBytes()' and 'readString()' functions prior to version 2.18.1. This issue arises in the BitStreamReader.h file, where the bounds check for the 'setBitPosition()' function fails to properly manage an overflowed value. Consequently, this leads to an attempt to read excessive bytes (up to 512 MB) from a buffer that only accommodates a few bytes. Such improper handling can cause segmentation faults, resulting in application crashes and potential denial of service. Users are encouraged to upgrade to version 2.18.1 or later to mitigate this issue.

References