CVE-2026-37540

Katalog CVE

CVSS 9.8 · Critical EPSS 0,45%

Kerentanan Integer Overflow or Wraparound pada linaro openamp. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

OpenAMP v2025.10.0 ELF loader contains an integer overflow vulnerability in firmware image parsing. In elf_loader.c, it performs multiplication of two attacker-controlled 16-bit values from the ELF header without overflow checking. On 32-bit embedded systems (STM32MP1, Zynq, i.MX), large values can cause the product to wrap around to a small value.

Rincian

Terbit di NVD

1 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381 advisory pihak ketiga
• https://github.com/OpenAMP/open-amp product
• https://github.com/OpenAMP/open-amp/blob/main/lib/remoteproc/elf_loader.c product