CVE-2026-33666 Details
Description
Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, in BitStreamReader.h readBytes() / readString(), the setBitPosition() bounds check receives the overflowed value and is completely bypassed. The code then reads len bytes (512 MB) from a buffer that is only a few bytes long, causing a segmentation fault. This vulnerability is fixed in 2.18.1.
A high-severity integer overflow vulnerability has been identified in the Zserio framework, specifically in the BitStreamReader component, prior to version 2.18.1. On 32-bit platforms, the readBytes() and readString() functions improperly handle variable-sized data, allowing an overflowed value to bypass bounds checks. This flaw enables the code to read up to 512 MB from a buffer only a few bytes long, resulting in a segmentation fault. This vulnerability impacts Zserio's C++ runtime and could disrupt Advanced Driver-Assistance Systems (ADAS) functionality in affected vehicles.
Users are advised to update to Zserio version 2.18.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ndsev/zserio/security/advisories/GHSA-fjwv-6wcr-vqwj | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/ndsev/zserio/security/advisories/GHSA-fjwv-6wcr-vqwj | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nds-association zserio | < 2.18.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 28, 2026 | Initial Analysis | [email protected] |
| Apr 27, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | New CVE Received | [email protected] |