CVE-2026-33524: 
Java vulnerability analysis and mitigation

CVE-2026-33524 is an unbounded memory allocation vulnerability in the zserio serialization framework's runtime libraries, classified as a Denial of Service (DoS) flaw. A crafted payload as small as 4–5 bytes can force memory allocations of up to 16 GB, crashing any process with an out-of-memory (OOM) error. All versions of zserio up to and including 2.18.0 are affected across both C++ and Java runtimes; the issue is fixed in version 2.18.1. It was reported on March 10, 2026, and publicly disclosed on April 24, 2026, following a 90-day coordinated disclosure timeline. The CVSS v3.1 base score is 7.5 (High) (Github Advisory, GitHub Security Advisory).

The root cause is CWE-789 (Memory Allocation with Excessive Size Value): array length or buffer size values read from untrusted input are used directly in memory allocation calls without any bounds validation. In the C++ runtime, cpp/runtime/src/zserio/Array.h (line 1029) calls m_rawArray.reserve(readLength) and cpp/runtime/src/zserio/BitStreamReader.h (lines 249, 281) calls value.reserve(len), both with unchecked attacker-controlled values. In the Java runtime, Array.java (line 271) executes rawArray.reset(readSize) leading to new int[readSize], and ByteArrayBitStreamReader.java (line 245) executes new byte[length], again without validation. An unauthenticated remote attacker can send a specially crafted 4–5 byte payload over any network interface that feeds data into the zserio deserializer, triggering massive memory allocation with an amplification factor of up to ~200 million times the payload size (Github Advisory, GitHub Security Advisory).

Successful exploitation causes complete process termination via OOM crash, resulting in a total loss of availability for any service relying on the zserio runtime. There is no confidentiality or integrity impact. The vulnerability is particularly significant given zserio's role as the serialization framework underlying the NDS (Navigation Data Standard), used by 43 automotive member companies including Toyota, BMW, Volkswagen, and Mercedes-Benz, with serialized data present in millions of vehicle deployments. Attack vectors include NDS.Live cloud map updates, map data supply chain compromise, and backend data processing pipelines; on 32-bit automotive ECUs, exploitation could affect ADAS functionality (GitHub Security Advisory).

A proof-of-concept demonstrating the DoS has been documented in the GitHub Security Advisory, with a concrete payload table showing that a 5-byte payload claiming 2,147,483,647 integers causes ~16 GB allocation and a system crash. The full PoC source code and Docker build files are available upon request from the reporter. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.04–0.08%, and the vulnerability is not currently listed in the CISA KEV catalog (Github Advisory, GitHub Security Advisory).

1. Reconnaissance: Identify services or applications that accept zserio-serialized data over the network, such as NDS.Live map update endpoints, automotive backend data pipelines, or any API consuming zserio-encoded binary streams.
2. Craft malicious payload: Construct a minimal 4–5 byte zserio-encoded payload where the varsize field encodes an extremely large value (e.g., 2,147,483,647) as the claimed array or string length. No authentication or special privileges are required.
3. Transmit payload: Send the crafted payload to the target service via the appropriate network protocol (e.g., HTTP, TCP socket, or map data feed) that feeds into the zserio deserializer.
4. Trigger unbounded allocation: The vulnerable Array.h, BitStreamReader.h (C++) or Array.java, ByteArrayBitStreamReader.java (Java) code reads the attacker-controlled size value and calls reserve() or new[] without validation, causing the process to attempt allocating up to 16 GB of memory.
5. Achieve DoS: The target process exhausts available system memory and crashes with an OOM error, rendering the service unavailable (GitHub Security Advisory).

• Network: Unusually small (4–5 byte) payloads sent to endpoints that consume zserio-serialized data; repeated connection attempts to map data or NDS.Live update services from unexpected sources.
• Logs: Application logs showing OOM errors or abrupt process termination immediately after receiving a small binary payload; Java heap space errors (java.lang.OutOfMemoryError) or C++ std::bad_alloc exceptions in service logs.
• Process: Sudden spike in memory consumption of the zserio-consuming process to near-system-capacity levels followed by process crash; repeated service restarts in a short time window.
• System: OS-level OOM killer logs (e.g., Linux dmesg entries with Out of memory: Kill process) referencing the affected application process (GitHub Security Advisory).

Upgrade to zserio version 2.18.1 or later, which is the official fix released by the ndsev/zserio maintainers (Github Advisory). The patch is available at the v2.18.1 release. If immediate patching is not possible, implement application-level validation to check that claimed array/buffer sizes do not exceed the remaining bytes in the input stream before allocation (if (claimedSize > remainingBytesInStream) { throw error(...); }). Additionally, restrict network access to zserio-consuming services to trusted sources only, and configure OS-level memory limits (e.g., ulimit, cgroups) to prevent a single process from exhausting all system memory.

The vulnerability was reported by security researcher Ryuji Yasukochi, who followed a 90-day coordinated disclosure process, initially notifying Woven by Toyota PSIRT on March 8, 2026, before public disclosure on April 24, 2026. The advisory highlights the broad automotive industry impact, noting zserio's use by 43 NDS member companies and millions of vehicle deployments, which drew attention from automotive cybersecurity communities. Coverage appeared on threat intelligence aggregators and security news feeds shortly after disclosure (Github Advisory).