An integer overflow in Zserio's BitStreamReader allows an attacker to craft a 4‑to‑5‑byte payload that triggers an unbounded memory allocation during deserialization. The resulting 16 GB allocation causes the host process to crash with an out‑of‑memory error, denying availability. This flaw falls under CWE‑789 (Uncontrolled Memory Allocation).

The vulnerability affects all versions of Zserio released before 2.18.1. The framework is distributed by ndsev under the Zserio project. No specific sub‑versions are listed, so any install older than 2.18.1 is potentially impacted.

The CVSS score of 7.5 reflects a high severity for denial of service. The EPSS score of less than 1% indicates that the probability of exploitation at this time is very low, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker can supply the crafted payload to the BitStreamReader, which occurs when a process deserializes data from an untrusted source. The attack vector is therefore inferred to be remote or local depending on how the library is used; if the framework is exposed over a network service, the flaw can be triggered remotely.