CVE-2026-33524
Nds-Association Zserio ≤ 2.18.1
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-33524 is a high-severity Memory Allocation with Excessive Size Value (CWE-789) vulnerability in Nds-Association Zserio. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 41th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SC-6 (Resource Availability) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33524 is a denial-of-service vulnerability in the Zserio framework, which provides compact and efficient serialization of structured data with low overhead. In versions prior to 2.18.1, a crafted payload as small as 4-5 bytes can force memory allocations of up to 16 GB, triggering an out-of-memory (OOM) error that crashes the affected process. The issue is tracked under CWE-789 (Uncontrolled Memory Allocation) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Attackers can exploit this vulnerability remotely over the network without authentication, privileges, or user interaction, requiring only low attack complexity. By delivering the malicious payload to any Zserio-parsing component in a target application, an unauthenticated remote attacker can cause severe memory exhaustion, reliably crashing the process and disrupting service availability.
The vulnerability is fixed in Zserio version 2.18.1. Practitioners should upgrade to this release or later to mitigate the issue. Additional details are available in the GitHub security advisory at https://github.com/ndsev/zserio/security/advisories/GHSA-cwq5-8pvq-j65j.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25591
Vulnerability Data
Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, a crafted payload as small as 4-5 bytes can force memory allocations of up to 16 GB, crashing any process…
more
with an OOM error (Denial of Service). This vulnerability is fixed in 2.18.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly rejects or bounds untrusted size values before any allocation occurs.
Resource quotas and priority allocation limit the system-wide impact of an oversized request.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent coding flaws that trust unvalidated size values for allocations.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect and block excessive allocation flaws before deployment.
Secure coding standards directly prohibit allocating memory from untrusted size values without validation.