Ndsev vulnerabilities
Published CVEs affecting Ndsev products: 2 record(s), with severity, exploitation and fixes.
CVE-2026-33666
High · 7.5
CWE-190 Apr 24, 2026
Zserio: Integer Overflow in BitStreamReader on 32-bit platforms
Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, in BitStreamReader.h readBytes() / readString(), the setBitPosition() bounds check receives the overflowed value and is completely bypassed. The code then reads len bytes (512 MB) from a buffer that is only a few bytes long, causing a segmentation fault. This vulnerability is fixed in 2.18.1.
CVE-2026-33524
High · 7.5
CWE-789 Apr 24, 2026
Zserio: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization
Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, a crafted payload as small as 4-5 bytes can force memory allocations of up to 16 GB, crashing any process with an OOM error (Denial of Service). This vulnerability is fixed in 2.18.1.