PT-2026-36514 · Openiam · Openam

Feng Ning · Published 2026-05-01 · Updated 2026-05-29 · CVE-2026-37540

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenAMP version 2025.10.0

Description The ELF loader contains an integer overflow during firmware image parsing. In the elf loader.c file, the system multiplies two attacker-controlled 16-bit values from the ELF header without performing overflow checks. On 32-bit embedded systems such as STM32MP1, Zynq, and i.MX, providing large values can cause the resulting product to wrap around to a small value.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2026-37540

Affected Products

Openam

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-37540 · Security Note
• https://github.com/OpenAMP/open-amp · Note
• https://github.com/OpenAMP/open-amp/blob/main/lib/remoteproc/elf_loader.c · Note
• https://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381 · Note
• https://twitter.com/infoflowcloud/status/2050270634991563012 · Twitter Post
• https://t.me/cveNotify/165177 · Telegram Post
• https://t.me/CVEtracker/52439 · Telegram Post
• https://twitter.com/CVEnew/status/2050269607823396907 · Twitter Post