CVE-2026-33491 Details

A stack-based buffer overflow vulnerability has been identified in the Zen C compiler, prior to version 0.4.4. This vulnerability allows attackers to cause a compiler crash or potentially execute arbitrary code by providing a specially crafted Zen C source file with excessively long struct, function, or trait identifiers. The issue arises from the compiler's use of fixed-size stack buffers for internal name mangling and identifier construction, which are vulnerable to overflow when handling long identifiers.

Users are advised to update to Zen C version 0.4.4 or later, where the vulnerability has been fixed by replacing fixed-size stack buffers with dynamically allocated ones, using safe formatting functions to prevent overflow, and aligning the handling of long identifiers across the compiler.