Vulnerability-Lookup

CVE-2026-33524 (GCVE-0-2026-33524)

Vulnerability from cvelistv5 – Published: 2026-04-24 18:18 – Updated: 2026-04-27 13:35

Title

Zserio: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization

Summary

Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, a crafted payload as small as 4-5 bytes can force memory allocations of up to 16 GB, crashing any process with an OOM error (Denial of Service). This vulnerability is fixed in 2.18.1.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-789 - Memory Allocation with Excessive Size Value

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/ndsev/zserio/security/advisori…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
ndsev	zserio	Affected: < 2.18.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33524",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-27T13:20:21.391216Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-27T13:35:28.660Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "zserio",
          "vendor": "ndsev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.18.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, a crafted payload as small as 4-5 bytes can force memory allocations of up to 16 GB, crashing any process with an OOM error (Denial of Service). This vulnerability is fixed in 2.18.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789: Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T18:18:02.913Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/ndsev/zserio/security/advisories/GHSA-cwq5-8pvq-j65j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ndsev/zserio/security/advisories/GHSA-cwq5-8pvq-j65j"
        }
      ],
      "source": {
        "advisory": "GHSA-cwq5-8pvq-j65j",
        "discovery": "UNKNOWN"
      },
      "title": "Zserio: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33524",
    "datePublished": "2026-04-24T18:18:02.913Z",
    "dateReserved": "2026-03-20T18:05:11.829Z",
    "dateUpdated": "2026-04-27T13:35:28.660Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-33524",
      "date": "2026-06-09",
      "epss": "0.00081",
      "percentile": "0.23919"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-33524\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-04-24T19:17:09.850\",\"lastModified\":\"2026-04-28T18:33:01.667\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, a crafted payload as small as 4-5 bytes can force memory allocations of up to 16 GB, crashing any process with an OOM error (Denial of Service). This vulnerability is fixed in 2.18.1.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-789\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nds-association:zserio:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.18.1\",\"matchCriteriaId\":\"5488B9D1-04B2-459B-BE23-2FF4A91D12CF\"}]}]}],\"references\":[{\"url\":\"https://github.com/ndsev/zserio/security/advisories/GHSA-cwq5-8pvq-j65j\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-33524\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-27T13:20:21.391216Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-27T13:20:22.417Z\"}}], \"cna\": {\"title\": \"Zserio: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization\", \"source\": {\"advisory\": \"GHSA-cwq5-8pvq-j65j\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"ndsev\", \"product\": \"zserio\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.18.1\"}]}], \"references\": [{\"url\": \"https://github.com/ndsev/zserio/security/advisories/GHSA-cwq5-8pvq-j65j\", \"name\": \"https://github.com/ndsev/zserio/security/advisories/GHSA-cwq5-8pvq-j65j\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, a crafted payload as small as 4-5 bytes can force memory allocations of up to 16 GB, crashing any process with an OOM error (Denial of Service). This vulnerability is fixed in 2.18.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-789\", \"description\": \"CWE-789: Memory Allocation with Excessive Size Value\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-04-24T18:18:02.913Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-33524\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-27T13:35:28.660Z\", \"dateReserved\": \"2026-03-20T18:05:11.829Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-04-24T18:18:02.913Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-33524

Vulnerability from fkie_nvd - Published: 2026-04-24 19:17 - Updated: 2026-04-28 18:33

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/ndsev/zserio/security/advisories/GHSA-cwq5-8pvq-j65j	Exploit, Mitigation, Vendor Advisory

Impacted products

	Vendor	Product	Version
	nds-association	zserio	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nds-association:zserio:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5488B9D1-04B2-459B-BE23-2FF4A91D12CF",
              "versionEndExcluding": "2.18.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, a crafted payload as small as 4-5 bytes can force memory allocations of up to 16 GB, crashing any process with an OOM error (Denial of Service). This vulnerability is fixed in 2.18.1."
    }
  ],
  "id": "CVE-2026-33524",
  "lastModified": "2026-04-28T18:33:01.667",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-04-24T19:17:09.850",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/ndsev/zserio/security/advisories/GHSA-cwq5-8pvq-j65j"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-789"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-CWQ5-8PVQ-J65J

Vulnerability from github – Published: 2026-04-24 16:25 – Updated: 2026-05-04 20:08

Summary

Zserio Runtime: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization

Details

Summary

Unbounded Memory Allocation (all platforms)

A crafted payload as small as 4-5 bytes can force memory allocations of up to 16 GB, crashing any process with an OOM error (Denial of Service).

Affected code (C++): - cpp/runtime/src/zserio/Array.h (line 1029) — m_rawArray.reserve(readLength) with unchecked readLength - cpp/runtime/src/zserio/BitStreamReader.h (lines 249, 281) — value.reserve(len) with unchecked len

Affected code (Java): - java/runtime/src/zserio/runtime/array/Array.java (line 271) — rawArray.reset(readSize) → new int[readSize] - java/runtime/src/zserio/runtime/io/ByteArrayBitStreamReader.java (line 245) — new byte[length]

Proof of Concept

Memory Allocation DoS (verified on 64-bit)

Payload	Claimed Size	Allocated	Amplification
4 bytes	100,000,000	762 MB	~200 million x
5 bytes	2,147,483,647	~16 GB	system crash

The full PoC source code and Docker build files are available upon request.

Impact

zserio is the serialization framework underlying the NDS (Navigation Data Standard), used by 43 member companies including Toyota, BMW, Volkswagen, Mercedes-Benz, and others. According to the Eclipse zserio project:

"Zserio serialized data is used in millions of deployments in cars on the road"

Attack vectors include NDS.Live cloud map updates, map data supply chain compromise, and backend data processing pipelines. On 32-bit automotive ECUs, this could affect ADAS functionality.

Suggested Fix

For all runtimes: Validate varsize against stream size

if (claimedSize > remainingBytesInStream) {
    throw error("varsize claims more data than available in stream");
}

Disclosure Timeline

2026-03-08: Reported to Woven by Toyota PSIRT (go-zserio)
2026-03-10: Reported to ndsev/zserio maintainers via GitHub Security Advisory
2026-03-23: Split off overflow vulnerability to own report
90-day coordinated disclosure timeline

A patch for this issue is available at https://github.com/ndsev/zserio/releases/tag/v2.18.1.

Reporter

Ryuji Yasukochi (ryuji.yasu@gmail.com)

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.18.0"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "io.github.ndsev:zserio-runtime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.18.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33524"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-24T16:25:11Z",
    "nvd_published_at": "2026-04-24T19:17:09Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\n### Unbounded Memory Allocation (all platforms)\n\nA crafted payload as small as 4-5 bytes can force memory allocations of up to 16 GB, crashing any process with an OOM error (Denial of Service).\n\n**Affected code (C++):**\n- `cpp/runtime/src/zserio/Array.h` (line 1029) \u2014 `m_rawArray.reserve(readLength)` with unchecked `readLength`\n- `cpp/runtime/src/zserio/BitStreamReader.h` (lines 249, 281) \u2014 `value.reserve(len)` with unchecked `len`\n\n**Affected code (Java):**\n- `java/runtime/src/zserio/runtime/array/Array.java` (line 271) \u2014 `rawArray.reset(readSize)` \u2192 `new int[readSize]`\n- `java/runtime/src/zserio/runtime/io/ByteArrayBitStreamReader.java` (line 245) \u2014 `new byte[length]`\n\n## Proof of Concept\n\n### Memory Allocation DoS (verified on 64-bit)\n\n| Payload | Claimed Size | Allocated | Amplification |\n|---------|-------------|-----------|---------------|\n| 4 bytes | 100,000,000 | 762 MB | ~200 million x |\n| 5 bytes | 2,147,483,647 | ~16 GB | system crash |\n\nThe full PoC source code and Docker build files are available upon request.\n\n## Impact\n\nzserio is the serialization framework underlying the **NDS (Navigation Data Standard)**, used by 43 member companies including Toyota, BMW, Volkswagen, Mercedes-Benz, and others. According to the Eclipse zserio project:\n\n\u003e \"Zserio serialized data is used in millions of deployments in cars on the road\"\n\nAttack vectors include NDS.Live cloud map updates, map data supply chain compromise, and backend data processing pipelines. On 32-bit automotive ECUs, this could affect ADAS functionality.\n\n## Suggested Fix\n\n### For all runtimes: Validate varsize against stream size\n\n```\nif (claimedSize \u003e remainingBytesInStream) {\n    throw error(\"varsize claims more data than available in stream\");\n}\n```\n\n## Disclosure Timeline\n\n- **2026-03-08:** Reported to Woven by Toyota PSIRT (go-zserio)\n- **2026-03-10:** Reported to ndsev/zserio maintainers via GitHub Security Advisory\n- **2026-03-23:** Split off overflow vulnerability to own report\n- **90-day coordinated disclosure timeline**\n\nA patch for this issue is available at https://github.com/ndsev/zserio/releases/tag/v2.18.1.\n\n## Reporter\n\nRyuji Yasukochi (ryuji.yasu@gmail.com)",
  "id": "GHSA-cwq5-8pvq-j65j",
  "modified": "2026-05-04T20:08:28Z",
  "published": "2026-04-24T16:25:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ndsev/zserio/security/advisories/GHSA-cwq5-8pvq-j65j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33524"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ndsev/zserio/commit/a9932de4b5eefb3afd5e18ca2fd758aa744a7c69"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ndsev/zserio"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Zserio Runtime: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-33524 (GCVE-0-2026-33524)

FKIE_CVE-2026-33524

GHSA-CWQ5-8PVQ-J65J

Summary

Unbounded Memory Allocation (all platforms)

Proof of Concept

Memory Allocation DoS (verified on 64-bit)

Impact

Suggested Fix

For all runtimes: Validate varsize against stream size

Disclosure Timeline

Reporter

Tags

Sightings

Nomenclature