The ndsev zserio framework, used for efficient serialization of structured data, contains a vulnerability (CVE-2026-33524) in versions before 2.18.1 where a specially crafted small payload can cause the software to allocate an excessively large amount of memory (up to 16 GB). This leads to process crashes due to out-of-memory conditions, resulting in a denial of service. The vulnerability is identified as CWE-789 and has a CVSS 3.1 base score of 7.5, indicating high severity. No known exploits are reported in the wild. The issue is resolved by upgrading to zserio version 2.18.1.

An attacker can cause a denial of service by sending a crafted payload that forces the vulnerable zserio process to allocate excessive memory, leading to out-of-memory errors and process crashes. There is no impact on confidentiality or integrity reported. The impact is limited to availability disruption of the affected application.

Upgrade the ndsev zserio framework to version 2.18.1 or later, where this vulnerability has been fixed. No other mitigation or workaround is documented. Patch status is confirmed by the vendor advisory stating the fix is included in version 2.18.1.