CVE-2026-33818

HighCVSS 7.5/10Last modified Sep 3, 2026

Description

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 13, 2026
Last modified
Sep 3, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-338199.8Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network.CVE-2026-33825.5A security flaw has been discovered in ChaiScript up to 6.1.0. The impacted element is the function chaiscript::Boxed_Number::get_as of the CVE-2026-338219.9Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a networkCVE-2026-338226.1Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.CVE-2026-338236.5Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network.CVE-2026-338249.8Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.CVE-2026-338257.8Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.CVE-2026-338268.0Improper input validation in Windows Active Directory allows an authorized attacker to execute code over an adjacent network.CVE-2026-338278.1Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attackeCVE-2026-338287.8Trust boundary violation in Windows Attestation allows an authorized attacker to elevate privileges locally.CVE-2026-338294.3Exposure of sensitive information to an unauthorized actor in Windows Snipping Tool allows an unauthorized attacker to perform spoofing overCVE-2026-33835.5A weakness has been identified in ChaiScript up to 6.1.0. This affects the function chaiscript::Boxed_Number::go of the file include/chaiscr
CVE-2026-33818: High severity, CVSS 7.5 | Vulnix