CVE-2026-37540: Integer Overflow
OpenAMP v2025.10.0 ELF loader contains an integer overflow vulnerability in firmware image parsing. In elfloader.c, it performs multiplication of two attacker-controlled 16-bit values from the ELF header without overflow checking. On 32-bit embedded systems (STM32MP1, Zynq, i.MX), large values can cause the product to wrap around to a small value.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-37540?
CVE-2026-37540 is considered a critical vulnerability due to its potential to cause buffer overflows on embedded systems.
How do I fix CVE-2026-37540?
To mitigate CVE-2026-37540, update the OpenAMP software to the latest version that addresses this vulnerability.
What systems are affected by CVE-2026-37540?
CVE-2026-37540 affects 32-bit embedded systems including STM32MP1, Zynq, and i.MX devices.
What type of vulnerability is CVE-2026-37540?
CVE-2026-37540 is an integer overflow vulnerability that occurs during ELF firmware image parsing.
Can CVE-2026-37540 be exploited remotely?
Yes, CVE-2026-37540 can be exploited remotely by attackers sending malicious ELF images to the affected systems.