CVE-2026-33491
Stack-Based Buffer Overflow in Zen C Compiler Allows Code Execution
Publication date: 2026-03-26
Last updated on: 2026-05-01
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zenc-lang | zen_c | to 0.4.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-33491 is a high-severity stack-based buffer overflow vulnerability in the Zen C compiler versions prior to 0.4.4. The issue occurs because the compiler uses fixed-size stack buffers without proper bounds checking when handling long struct, function, or trait identifiers during name mangling and method overload resolution.
Specifically, unsafe functions like sprintf and strcat are used to format or concatenate identifiers into buffers of limited size (256 or 1024 bytes), which can be overflowed by excessively long identifiers. This overflow can cause memory corruption, leading to compiler crashes or potentially arbitrary code execution.
The vulnerability can be triggered by providing a specially crafted Zen C source file with very long identifiers, causing the compiler to write beyond buffer boundaries during compilation.
How can this vulnerability impact me? :
This vulnerability can impact users by causing the Zen C compiler to crash, resulting in denial of service during compilation.
More seriously, in environments where untrusted code is compiled (such as automated build systems or online IDEs), an attacker could exploit this buffer overflow to execute arbitrary code within the compiler process, potentially compromising the system.
The vulnerability has a high CVSS score of 7.8, indicating significant impacts on confidentiality, integrity, and availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to compile specially crafted Zen C source files (.zc) containing excessively long struct, function, or trait identifiers (e.g., longer than 1024 characters). Such inputs can trigger a stack-based buffer overflow in vulnerable versions of the Zen C compiler.
A proof-of-concept Python script exists that generates a Zen C source file with a 300-character struct name causing a stack-buffer-overflow error when compiled with AddressSanitizer-enabled builds.
To detect the vulnerability on your system, you can compile a test Zen C source file with very long identifiers using a vulnerable version of the compiler and observe if it crashes or reports a stack-buffer-overflow error.
- Use AddressSanitizer-enabled build of Zen C compiler to catch buffer overflow errors during compilation.
- Compile a Zen C source file with a long struct name, for example, a file containing: `struct ` followed by a 300+ character identifier.
- Example command to compile with AddressSanitizer (assuming zencc is the compiler): `zencc -fsanitize=address test_long_identifier.zc`
- Observe compiler output for stack-buffer-overflow or crash indications.
What immediate steps should I take to mitigate this vulnerability?
The primary and immediate mitigation step is to upgrade the Zen C compiler to version v0.4.4 or later, where the vulnerability has been fixed.
The patch replaces fixed-size stack buffers with dynamically allocated buffers, uses safer functions like snprintf instead of sprintf, and aligns mangling schemes to prevent buffer overflows.
Until the upgrade can be applied, avoid compiling untrusted or malicious Zen C source files containing excessively long identifiers, especially in automated build systems or online IDE environments.
- Upgrade Zen C compiler to version v0.4.4 or later.
- Restrict or validate input source files to prevent excessively long struct, function, or trait identifiers.
- Use compiler builds with AddressSanitizer enabled to detect attempts to exploit the vulnerability during development or testing.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of the CVE-2026-33491 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.