CVE-2026-37540 is a high severity integer overflow (CVSS 8.4) in the ELF loader of OpenAMP v2025.10.0. Two header values are multiplied without an overflow check, which can wrap to a small number on 32-bit embedded targets. The record names no fixed version, so check the OpenAMP project before assuming you are safe.
What's affected
The record lists OpenAMP v2025.10.0, in the file lib/remoteproc/elf_loader.c. It describes the risk for 32-bit embedded systems such as STM32MP1, Zynq and i.MX.
The record does not name a fixed version. Check the OpenAMP repository for a commit or release that addresses it before you rely on any particular tag.
How to check if you're exposed
OpenAMP is usually vendored into firmware or a board support package, so start with your source tree:
grep -rn "elf_loader" --include=CMakeLists.txt --include=*.mk .
git -C path/to/open-amp describe --tags
Also check your SBOM or vendor SDK release notes for the bundled OpenAMP version.
What to do now
- Find every product or image that bundles OpenAMP v2025.10.0.
- Watch the OpenAMP repository for a fix and plan to pick it up when it lands.
- Until then, only load firmware images from sources you trust and verify their signatures before they reach the loader.
- Ask your SoC or board vendor whether their SDK carries a patched copy.
After patching, run the free in-browser dependency scan at gold.safeguard.sh/scan to find other copies of the affected package. Reachability analysis then helps you decide which findings in your own code deserve attention first.
Why it matters
This is CWE-190 (Integer Overflow or Wraparound). When two attacker-controlled 16-bit header fields are multiplied in a 32-bit type, the product can wrap to a small value. Code that then sizes a buffer or bounds a loop from that value can be driven out of range.
The vector is local (AV:L) with no privileges needed, so the practical exposure depends on who can supply a firmware image to the loader. The record does not flag this CVE as exploited in the wild.
Quick check
Is there a fixed version?
The record does not name one. Check the OpenAMP repository.
Why does 32-bit matter?
The record says the product can wrap to a small value on 32-bit embedded systems.
Sources
Scan your own dependencies for free at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
