Cyber Posture

CVE-2026-33491

HighPublic PoC

Published: 26 March 2026

Published
26 March 2026
Modified
01 May 2026
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0002 5.0th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-33491 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Zenc-Lang Zen C. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 5.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

preventrecover

Directly requires timely remediation of the stack-based buffer overflow flaw in the Zen C compiler by patching to version 0.4.4 or later.

prevent

Implements memory protections such as stack canaries, ASLR, or DEP to prevent arbitrary code execution from exploitation of the stack-based buffer overflow.

prevent

Requires validation of information inputs like excessively long identifiers in Zen C source files to block the trigger for the buffer overflow vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

Buffer overflow in Zen C compiler enables RCE when victim compiles attacker-crafted .zc source file (user interaction, no privileges needed); directly maps to exploitation of client software for execution and delivery via malicious file.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Zen C is a systems programming language that compiles to human-readable GNU C/C11. Prior to version 0.4.4, a stack-based buffer overflow vulnerability in the Zen C compiler allows attackers to cause a compiler crash or potentially execute arbitrary code by…

more

providing a specially crafted Zen C source file (`.zc`) with excessively long struct, function, or trait identifiers. Users are advised to update to Zen C version v0.4.4 or later to receive a patch.

Deeper analysisAI

CVE-2026-33491 is a stack-based buffer overflow vulnerability (CWE-121, CWE-787) in the Zen C compiler, a systems programming language that compiles to human-readable GNU C/C11. The issue affects versions prior to 0.4.4 and is triggered by processing a specially crafted Zen C source file (.zc) containing excessively long struct, function, or trait identifiers. It has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability.

An attacker with local access to a system running the vulnerable Zen C compiler can exploit this by tricking a user into compiling a malicious .zc file, which requires user interaction but no special privileges. Successful exploitation can cause the compiler to crash or, in some cases, allow arbitrary code execution on the host machine where the compilation occurs.

The GitHub security advisory at https://github.com/zenc-lang/zenc/security/advisories/GHSA-rv74-w6q7-h8xr recommends updating to Zen C version v0.4.4 or later, which includes a patch to address the buffer overflow.

Details

CWE(s)

Affected Products

zenc-lang
zen c
≤ 0.4.4

CVEs Like This One

CVE-2026-28207Same product: Zenc-Lang Zen C
CVE-2025-27168Shared CWE-121, CWE-787
CVE-2026-1361Shared CWE-121, CWE-787
CVE-2025-21163Shared CWE-121, CWE-787
CVE-2026-5726Shared CWE-121, CWE-787
CVE-2026-30987Shared CWE-121, CWE-787
CVE-2025-2151Shared CWE-121, CWE-787
CVE-2026-25502Shared CWE-121, CWE-787
CVE-2026-31795Shared CWE-121, CWE-787
CVE-2026-30983Shared CWE-121, CWE-787

References