CVE-2026-33524: Zserio Runtime: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization

April 24, 2026 (updated May 4, 2026)

Zserio Runtime: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization

References

github.com/advisories/GHSA-cwq5-8pvq-j65j
github.com/ndsev/zserio/commit/a9932de4b5eefb3afd5e18ca2fd758aa744a7c69
github.com/ndsev/zserio/security/advisories/GHSA-cwq5-8pvq-j65j
nvd.nist.gov/vuln/detail/CVE-2026-33524

Code Behaviors & Features

Detect and mitigate CVE-2026-33524 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →