Vulnerability DatabaseCVE-2026-37540
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-37540
Published:May 01, 2026
Updated:August 06, 2026
OpenAMP v2025.10.0 ELF loader contains an integer overflow vulnerability in firmware image parsing. In elf_loader.c, it performs multiplication of two attacker-controlled 16-bit values from the ELF header without overflow checking. On 32-bit embedded systems (STM32MP1, Zynq, i.MX), large values can cause the product to wrap around to a small value.
Related Resources (5)
https://github.com/OpenAMP/open-amp
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/37xxx/CVE-2026-37540.json
https://nvd.nist.gov/vuln/detail/CVE-2026-37540
https://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381
https://github.com/OpenAMP/open-amp/blob/main/lib/remoteproc/elf_loader.c
Do you need more information?
Contact Us
CVSS v4
Base Score:
8.6
Attack Vector
LOCAL
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
8.4
Attack Complexity
LOW
Attack Vector
LOCAL
Availability
HIGH
Confidentiality
HIGH
Integrity
HIGH
Privileges Required
NONE
Scope
UNCHANGED
User Interaction
NONE
Weakness Type (CWE)
Integer Overflow or Wraparound
CWE-190
EPSS
Base Score:
0.25