Vulnerability details

CVE-2026-33491

zenc-lang zenc

Zen-C has Stack-Based Buffer Overflow in Identifier Mangling

CVSS 3.1

7.8High

Official description

Zen C is a systems programming language that compiles to human-readable GNU C/C11. Prior to version 0.4.4, a stack-based buffer overflow vulnerability in the Zen C compiler allows attackers to cause a compiler crash or potentially execute arbitrary code by providing a specially crafted Zen C source file (`.zc`) with excessively long struct, function, or trait identifiers. Users are advised to update to Zen C version v0.4.4 or later to receive a patch.

CVSS scores

Score	Version	Source	Vector
7.8High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
zenc-lang	zenc	< 0.4.4	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/zenc-lang/zenc/security/advisories/GHSA-rv74-w6q7-h8xr x_refsource_CONFIRM

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-03-26
Last updated: 2026-03-27
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.24%

Probability of exploitation in 30 days

15.6%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Total

Weaknesses (CWE)

CWE-121
Stack-based Buffer Overflow
CWE-787
Out-of-bounds Write