Zserio’s BitStreamReader functions readBytes() and readString() perform a bounds check on the number of bytes to read. On 32‑bit platforms the length calculation overflows, causing the check to be bypassed. The code then attempts to read an overflowed 512 MB of data from a buffer that is only a few bytes, resulting in a segmentation fault. The vulnerability does not allow arbitrary code execution or privilege escalation, but any process that uses the vulnerable Zserio library will be vulnerable to a crash that may lead to service disruption.

All installations of the Zserio serialization framework from the ndsev repository running a version prior to 2.18.1 are affected. No specific distribution or build is listed, so any build that includes BitStreamReader.h without the patch is vulnerable.

The CVSS score of 7.5 indicates a high impact if exploited. The EPSS score of less than 1 % suggests modest likelihood of exploitation, which is unsurprising given the local‑only nature of the flaw. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker who can supply crafted serialized data to the vulnerable application; the resulting crash can be leveraged to cause a denial of service. Based on the description, the likely attack vector is local, with an adversary injecting malicious input into an application that uses Zserio.