CVE-2026-82737: CWE-190 Integer Overflow or Wraparound in ash-project ash
Description
Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements. Ash.Vector.new/1 (lib/ash/vector.ex) encodes a vector as <<dim::unsigned-16, 0::unsigned-16>> followed by the element floats, packing the element count into a 16-bit field without checking its range. A list of more than 65,535 elements wraps the dimension modulo 65,536, so the encoded header records a dimension that disagrees with the number of stored floats. from_binary/1 later reads binary-size(dim)-unit(32) from the wrapped header, so every read of the corrupted value misparses and raises, denying access to the affected record. The fix rejects any vector whose dimension exceeds 65,535. This issue affects ash: from 2.14.13 before 3.32.2.
CVSS v4.0
Score 5.9medium
Affected software
ash-project
ash
ash-project
ash
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises because Ash.Vector.new/1 encodes the vector dimension in a 16-bit unsigned integer without validating the input size. When a vector larger than 65,535 elements is submitted, the dimension value wraps modulo 65,536, causing a mismatch between the recorded dimension and the actual number of elements. Subsequent reads using from_binary/1 interpret the corrupted header incorrectly, leading to parsing errors and crashes that deny access to the affected vector record. The fix involves rejecting vectors with dimensions exceeding 65,535 elements.
Potential Impact
An attacker can cause denial of service by submitting an oversized vector that corrupts the stored data structure, resulting in crashes when the vector is accessed. This disrupts normal operation by preventing access to the corrupted vector data. There is no indication of privilege escalation or remote code execution. The CVSS 4.0 score of 5.9 reflects a medium severity with local attack vector and partial impact on integrity and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix rejects vectors exceeding 65,535 elements, so upgrading to a version that includes this validation is recommended once available. Until then, avoid processing vectors with more than 65,535 elements to prevent triggering the overflow.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- EEF
- Date Reserved
- 2026-08-31T00:59:10.002Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a964897acd9273b49296a87
Added to database: 09/01/2026, 03:37:59 UTC
Last enriched: 09/07/2026, 15:04:25 UTC
Last updated: 10/15/2026, 06:48:19 UTC
Views: 76
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.