CVE-2026-33524

Summary (CVE-2026-33524): Zserio v2.18.0 and earlier are vulnerable to a Denial of Service via unbounded memory allocations during deserialization caused by an integer overflow in BitStreamReader/Array handling. A crafted payload as small as 4–5 bytes can trigger allocations up to 16 GB, crashing...