CVE-2026-33524: Nds-Association Zserio

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, a crafted payload as small as 4-5 bytes can force memory allocations of up to 16 GB, crashing any process with an OOM error (Denial of Service). This vulnerability is fixed in 2.18.1.

Affected products

• Nds-Association Zserio: before 2.18.1 (fixed in 2.18.1)

Published 2026-04-24. Last modified 2026-06-17.