CVE-2026-37540 identifies an integer overflow vulnerability in the ELF loader of OpenAMP v2025.10.0. Specifically, in elf_loader.c, the code multiplies two 16-bit values from the ELF header controlled by an attacker without checking for overflow. On 32-bit embedded systems such as STM32MP1, Zynq, and i.MX, this multiplication can overflow and wrap around to a smaller value, potentially leading to incorrect parsing of firmware images. This flaw can be exploited to cause high impact on system confidentiality, integrity, and availability. The vulnerability is rated with a CVSS 3.1 score of 8.4 (high severity). No patch or official remediation level has been disclosed as of the published date.

The integer overflow in the ELF loader can cause incorrect parsing of firmware images on affected 32-bit embedded platforms. This may lead to severe consequences affecting confidentiality, integrity, and availability of the system. The CVSS score of 8.4 reflects the potential for high impact if exploited. However, no known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, cautious handling of ELF firmware images from untrusted sources is advised.