What is the CVSS score of CVE-2026-33491?

CVE-2026-33491 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Zenc are affected by CVE-2026-33491?

Zen C compiler versions prior to 0.4.4 contain a stack-based buffer overflow vulnerability that can lead to arbitrary code execution when processing malicious source files with excessively long…. A patch is available.

How to fix or mitigate CVE-2026-33491?

Within 24 hours: Identify all systems running Zen C compiler versions prior to 0.4.4 and restrict compilation of untrusted or externally-sourced .zc files. Within 7 days: Apply vendor-released patch to upgrade Zen C compiler to version 0.4.4 or later on all development and build systems. Within 30 days: Conduct code review of any compiled artifacts generated by pre-0.4.4 versions, particularly those derived from third-party or external source submissions.

Zenc CVE-2026-33491

EUVD-2026-16319 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-26 GitHub_M

Buffer Overflow RCE Stack Overflow Zenc

7.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:13 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

0.4.4

EUVD ID Assigned

Mar 26, 2026 - 19:00 euvd

EUVD-2026-16319

Analysis Generated

Mar 26, 2026 - 19:00 vuln.today

CVE Published

Mar 26, 2026 - 18:39 nvd

HIGH 7.8

DescriptionGitHub Advisory

Zen C is a systems programming language that compiles to human-readable GNU C/C11. Prior to version 0.4.4, a stack-based buffer overflow vulnerability in the Zen C compiler allows attackers to cause a compiler crash or potentially execute arbitrary code by providing a specially crafted Zen C source file (.zc) with excessively long struct, function, or trait identifiers. Users are advised to update to Zen C version v0.4.4 or later to receive a patch.

AnalysisAI

The Zen C compiler (versions prior to 0.4.4) crashes or enables arbitrary code execution when processing maliciously crafted .zc source files containing excessively long identifiers for structs, functions, or traits, triggering a stack-based buffer overflow (CWE-121). A proof-of-concept exploit exists per SSVC assessment, though attack complexity remains moderate as it requires local access and user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R). Vendor-released patch: version 0.4.4.

Technical ContextAI

Zen C is a systems programming language that transpiles to human-readable GNU C/C11 code. The vulnerability (CWE-121: Stack-based Buffer Overflow) resides in the compiler's identifier parsing logic, where insufficient bounds checking allows attackers to overflow stack-allocated buffers during compilation of source files. The affected product is identified via CPE cpe:2.3:a:zenc-lang:zenc:*:*:*:*:*:*:*:* covering all versions prior to 0.4.4. Stack-based buffer overflows occur when data written to a buffer exceeds its allocated stack memory region, potentially overwriting return addresses or function pointers to redirect program execution. In this compiler context, the overflow occurs during the compilation phase rather than in compiled output, making the compiler itself the attack surface.

RemediationAI

Upgrade Zen C compiler to version 0.4.4 or later to receive the vendor-released patch addressing the stack buffer overflow, as documented in the GitHub security advisory at https://github.com/zenc-lang/zenc/security/advisories/GHSA-rv74-w6q7-h8xr. Organizations unable to immediately upgrade should implement compensating controls including restricting compilation to trusted source files only, implementing code review processes for all .zc files before compilation, and isolating compiler execution in sandboxed or containerized environments with limited privileges. Continuous integration pipelines should validate source file identifier lengths before compilation and consider implementing automated static analysis to detect suspicious patterns in source files prior to compiler invocation.