Vulnerability-Lookup

CVE-2026-82737 (GCVE-0-2026-82737)

Vulnerability from cvelistv5 – Published: 2026-09-01 03:24 – Updated: 2026-09-01 12:56

Title

Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads

Summary

Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements. Ash.Vector.new/1 (lib/ash/vector.ex) encodes a vector as <<dim::unsigned-16, 0::unsigned-16>> followed by the element floats, packing the element count into a 16-bit field without checking its range. A list of more than 65,535 elements wraps the dimension modulo 65,536, so the encoded header records a dimension that disagrees with the number of stored floats. from_binary/1 later reads binary-size(dim)-unit(32) from the wrapped header, so every read of the corrupted value misparses and raises, denying access to the affected record. The fix rejects any vector whose dimension exceeds 65,535. This issue affects ash: from 2.14.13 before 3.32.2.

Severity

5.9 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-01 12:55 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

EEF mitre root

References

4 references

URL	Tags
https://github.com/ash-project/ash/security/advis…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-82737.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-82737	related
https://github.com/ash-project/ash/commit/cef5eb7…	patch

Impacted products

2 products

Vendor	Product	Version	CPE status
ash-project	ash	Affected: 2.14.13 , < 3.32.2 (semver) cpe:2.3:a:ash-project:ash::::::::
ash-project	ash	Affected: e2855843ca4a9141dcd7f40f47227e13b43f0e00 , < cef5eb7b0693f04d1699a36e02a4e09ce1e7bffe (git) cpe:2.3:a:ash-project:ash::::::::

Credits

Jonatan Männchen / EEF Zach Daniel / Ash Project Peter Ullrich Peter Ullrich

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82737",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-01T12:55:44.794250Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T12:56:53.991Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/ash-project/ash/security/advisories/GHSA-68q3-w4w3-2gfv"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Ash.Vector\u0027"
          ],
          "packageName": "ash",
          "packageURL": "pkg:hex/ash",
          "product": "ash",
          "programFiles": [
            "lib/ash/vector.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Ash.Vector\u0027:new/1"
            },
            {
              "name": "\u0027Elixir.Ash.Vector\u0027:from_binary/1"
            }
          ],
          "repo": "https://github.com/ash-project/ash",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "3.32.2",
              "status": "affected",
              "version": "2.14.13",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Ash.Vector\u0027"
          ],
          "packageName": "ash-project/ash",
          "packageURL": "pkg:github/ash-project/ash",
          "product": "ash",
          "programFiles": [
            "lib/ash/vector.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Ash.Vector\u0027:new/1"
            },
            {
              "name": "\u0027Elixir.Ash.Vector\u0027:from_binary/1"
            }
          ],
          "repo": "https://github.com/ash-project/ash",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "cef5eb7b0693f04d1699a36e02a4e09ce1e7bffe",
              "status": "affected",
              "version": "e2855843ca4a9141dcd7f40f47227e13b43f0e00",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.32.2",
                  "versionStartIncluding": "2.14.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Zach Daniel / Ash Project"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eInteger Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.Vector.new/1\u003c/code\u003e (\u003ccode\u003elib/ash/vector.ex\u003c/code\u003e) encodes a vector as \u003ccode\u003e\u0026lt;\u0026lt;dim::unsigned-16, 0::unsigned-16\u0026gt;\u0026gt;\u003c/code\u003e followed by the element floats, packing the element count into a 16-bit field without checking its range. A list of more than 65,535 elements wraps the dimension modulo 65,536, so the encoded header records a dimension that disagrees with the number of stored floats. \u003ccode\u003efrom_binary/1\u003c/code\u003e later reads \u003ccode\u003ebinary-size(dim)-unit(32)\u003c/code\u003e from the wrapped header, so every read of the corrupted value misparses and raises, denying access to the affected record. The fix rejects any vector whose dimension exceeds 65,535.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 2.14.13 before 3.32.2.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements.\n\n`Ash.Vector.new/1` (`lib/ash/vector.ex`) encodes a vector as `\u003c\u003cdim::unsigned-16, 0::unsigned-16\u003e\u003e` followed by the element floats, packing the element count into a 16-bit field without checking its range. A list of more than 65,535 elements wraps the dimension modulo 65,536, so the encoded header records a dimension that disagrees with the number of stored floats. `from_binary/1` later reads `binary-size(dim)-unit(32)` from the wrapped header, so every read of the corrupted value misparses and raises, denying access to the affected record. The fix rejects any vector whose dimension exceeds 65,535.\n\nThis issue affects ash: from 2.14.13 before 3.32.2."
            }
          ],
          "value": "Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements.\n\nAsh.Vector.new/1 (lib/ash/vector.ex) encodes a vector as \u003c\u003cdim::unsigned-16, 0::unsigned-16\u003e\u003e followed by the element floats, packing the element count into a 16-bit field without checking its range. A list of more than 65,535 elements wraps the dimension modulo 65,536, so the encoded header records a dimension that disagrees with the number of stored floats. from_binary/1 later reads binary-size(dim)-unit(32) from the wrapped header, so every read of the corrupted value misparses and raises, denying access to the affected record. The fix rejects any vector whose dimension exceeds 65,535.\n\nThis issue affects ash: from 2.14.13 before 3.32.2."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-92",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-92 Forced Integer Overflow"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T03:24:14.969Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/ash-project/ash/security/advisories/GHSA-68q3-w4w3-2gfv"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-82737.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-82737"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ash-project/ash/commit/cef5eb7b0693f04d1699a36e02a4e09ce1e7bffe"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-82737",
    "datePublished": "2026-09-01T03:24:14.969Z",
    "dateReserved": "2026-08-31T00:59:10.002Z",
    "dateUpdated": "2026-09-01T12:56:53.991Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-82737",
      "date": "2026-09-01",
      "epss": "0.00138",
      "percentile": "0.03482"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-82737\",\"sourceIdentifier\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"published\":\"2026-09-01T04:18:03.193\",\"lastModified\":\"2026-09-01T13:20:03.490\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements.\\n\\nAsh.Vector.new/1 (lib/ash/vector.ex) encodes a vector as \u003c\u003cdim::unsigned-16, 0::unsigned-16\u003e\u003e followed by the element floats, packing the element count into a 16-bit field without checking its range. A list of more than 65,535 elements wraps the dimension modulo 65,536, so the encoded header records a dimension that disagrees with the number of stored floats. from_binary/1 later reads binary-size(dim)-unit(32) from the wrapped header, so every read of the corrupted value misparses and raises, denying access to the affected record. The fix rejects any vector whose dimension exceeds 65,535.\\n\\nThis issue affects ash: from 2.14.13 before 3.32.2.\"}],\"affected\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"affectedData\":[{\"vendor\":\"ash-project\",\"product\":\"ash\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.hex.pm\",\"packageName\":\"ash\",\"cpes\":[\"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.Ash.Vector\u0027\"],\"programFiles\":[\"lib/ash/vector.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.Ash.Vector\u0027:new/1\"},{\"name\":\"\u0027Elixir.Ash.Vector\u0027:from_binary/1\"}],\"repo\":\"https://github.com/ash-project/ash\",\"packageURL\":\"pkg:hex/ash\",\"versions\":[{\"version\":\"2.14.13\",\"lessThan\":\"3.32.2\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"ash-project\",\"product\":\"ash\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com\",\"packageName\":\"ash-project/ash\",\"cpes\":[\"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.Ash.Vector\u0027\"],\"programFiles\":[\"lib/ash/vector.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.Ash.Vector\u0027:new/1\"},{\"name\":\"\u0027Elixir.Ash.Vector\u0027:from_binary/1\"}],\"repo\":\"https://github.com/ash-project/ash\",\"packageURL\":\"pkg:github/ash-project/ash\",\"versions\":[{\"version\":\"e2855843ca4a9141dcd7f40f47227e13b43f0e00\",\"lessThan\":\"cef5eb7b0693f04d1699a36e02a4e09ce1e7bffe\",\"versionType\":\"git\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-01T12:55:44.794250Z\",\"id\":\"CVE-2026-82737\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-190\"}]}],\"references\":[{\"url\":\"https://cna.erlef.org/cves/CVE-2026-82737.html\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ash-project/ash/commit/cef5eb7b0693f04d1699a36e02a4e09ce1e7bffe\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ash-project/ash/security/advisories/GHSA-68q3-w4w3-2gfv\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://osv.dev/vulnerability/EEF-CVE-2026-82737\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ash-project/ash/security/advisories/GHSA-68q3-w4w3-2gfv\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"affected\": [{\"collectionURL\": \"https://repo.hex.pm\", \"cpes\": [\"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*\"], \"defaultStatus\": \"unaffected\", \"modules\": [\"\u0027Elixir.Ash.Vector\u0027\"], \"packageName\": \"ash\", \"packageURL\": \"pkg:hex/ash\", \"product\": \"ash\", \"programFiles\": [\"lib/ash/vector.ex\"], \"programRoutines\": [{\"name\": \"\u0027Elixir.Ash.Vector\u0027:new/1\"}, {\"name\": \"\u0027Elixir.Ash.Vector\u0027:from_binary/1\"}], \"repo\": \"https://github.com/ash-project/ash\", \"vendor\": \"ash-project\", \"versions\": [{\"lessThan\": \"3.32.2\", \"status\": \"affected\", \"version\": \"2.14.13\", \"versionType\": \"semver\"}]}, {\"collectionURL\": \"https://github.com\", \"cpes\": [\"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*\"], \"defaultStatus\": \"unaffected\", \"modules\": [\"\u0027Elixir.Ash.Vector\u0027\"], \"packageName\": \"ash-project/ash\", \"packageURL\": \"pkg:github/ash-project/ash\", \"product\": \"ash\", \"programFiles\": [\"lib/ash/vector.ex\"], \"programRoutines\": [{\"name\": \"\u0027Elixir.Ash.Vector\u0027:new/1\"}, {\"name\": \"\u0027Elixir.Ash.Vector\u0027:from_binary/1\"}], \"repo\": \"https://github.com/ash-project/ash\", \"vendor\": \"ash-project\", \"versions\": [{\"lessThan\": \"cef5eb7b0693f04d1699a36e02a4e09ce1e7bffe\", \"status\": \"affected\", \"version\": \"e2855843ca4a9141dcd7f40f47227e13b43f0e00\", \"versionType\": \"git\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.32.2\", \"versionStartIncluding\": \"2.14.13\", \"vulnerable\": true}], \"negate\": false, \"operator\": \"OR\"}], \"operator\": \"AND\"}], \"credits\": [{\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Zach Daniel / Ash Project\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Peter Ullrich\"}], \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"\u003cp\u003eInteger Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements.\u003c/p\u003e\\n\u003cp\u003e\u003ccode\u003eAsh.Vector.new/1\u003c/code\u003e (\u003ccode\u003elib/ash/vector.ex\u003c/code\u003e) encodes a vector as \u003ccode\u003e\u0026lt;\u0026lt;dim::unsigned-16, 0::unsigned-16\u0026gt;\u0026gt;\u003c/code\u003e followed by the element floats, packing the element count into a 16-bit field without checking its range. A list of more than 65,535 elements wraps the dimension modulo 65,536, so the encoded header records a dimension that disagrees with the number of stored floats. \u003ccode\u003efrom_binary/1\u003c/code\u003e later reads \u003ccode\u003ebinary-size(dim)-unit(32)\u003c/code\u003e from the wrapped header, so every read of the corrupted value misparses and raises, denying access to the affected record. The fix rejects any vector whose dimension exceeds 65,535.\u003c/p\u003e\\n\u003cp\u003eThis issue affects ash: from 2.14.13 before 3.32.2.\u003c/p\u003e\"}, {\"base64\": false, \"type\": \"text/markdown\", \"value\": \"Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements.\\n\\n`Ash.Vector.new/1` (`lib/ash/vector.ex`) encodes a vector as `\u003c\u003cdim::unsigned-16, 0::unsigned-16\u003e\u003e` followed by the element floats, packing the element count into a 16-bit field without checking its range. A list of more than 65,535 elements wraps the dimension modulo 65,536, so the encoded header records a dimension that disagrees with the number of stored floats. `from_binary/1` later reads `binary-size(dim)-unit(32)` from the wrapped header, so every read of the corrupted value misparses and raises, denying access to the affected record. The fix rejects any vector whose dimension exceeds 65,535.\\n\\nThis issue affects ash: from 2.14.13 before 3.32.2.\"}], \"value\": \"Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements.\\n\\nAsh.Vector.new/1 (lib/ash/vector.ex) encodes a vector as \u003c\u003cdim::unsigned-16, 0::unsigned-16\u003e\u003e followed by the element floats, packing the element count into a 16-bit field without checking its range. A list of more than 65,535 elements wraps the dimension modulo 65,536, so the encoded header records a dimension that disagrees with the number of stored floats. from_binary/1 later reads binary-size(dim)-unit(32) from the wrapped header, so every read of the corrupted value misparses and raises, denying access to the affected record. The fix rejects any vector whose dimension exceeds 65,535.\\n\\nThis issue affects ash: from 2.14.13 before 3.32.2.\"}], \"impacts\": [{\"capecId\": \"CAPEC-92\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-92 Forced Integer Overflow\"}]}], \"metrics\": [{\"cvssV4_0\": {\"Automatable\": \"NOT_DEFINED\", \"Recovery\": \"NOT_DEFINED\", \"Safety\": \"NOT_DEFINED\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"attackVector\": \"LOCAL\", \"baseScore\": 5.9, \"baseSeverity\": \"MEDIUM\", \"privilegesRequired\": \"NONE\", \"providerUrgency\": \"NOT_DEFINED\", \"subAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N\", \"version\": \"4.0\", \"vulnAvailabilityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-190\", \"description\": \"CWE-190 Integer Overflow or Wraparound\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-09-01T03:24:14.969Z\"}, \"references\": [{\"tags\": [\"vendor-advisory\", \"related\"], \"url\": \"https://github.com/ash-project/ash/security/advisories/GHSA-68q3-w4w3-2gfv\"}, {\"tags\": [\"related\"], \"url\": \"https://cna.erlef.org/cves/CVE-2026-82737.html\"}, {\"tags\": [\"related\"], \"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-82737\"}, {\"tags\": [\"patch\"], \"url\": \"https://github.com/ash-project/ash/commit/cef5eb7b0693f04d1699a36e02a4e09ce1e7bffe\"}], \"source\": {\"discovery\": \"EXTERNAL\"}, \"title\": \"Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads\"}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-82737\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-01T12:55:44.794250Z\"}}}], \"references\": [{\"url\": \"https://github.com/ash-project/ash/security/advisories/GHSA-68q3-w4w3-2gfv\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-01T12:56:03.522Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-82737\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"EEF\", \"dateReserved\": \"2026-08-31T00:59:10.002Z\", \"datePublished\": \"2026-09-01T03:24:14.969Z\", \"dateUpdated\": \"2026-09-01T12:56:53.991Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-82737

Vulnerability from fkie_nvd - Published: 2026-09-01 04:18 - Updated: 2026-09-01 13:20

Severity

5.9 (Medium) - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://cna.erlef.org/cves/CVE-2026-82737.html
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/ash-project/ash/commit/cef5eb7b0693f04d1699a36e02a4e09ce1e7bffe
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/ash-project/ash/security/advisories/GHSA-68q3-w4w3-2gfv
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://osv.dev/vulnerability/EEF-CVE-2026-82737
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/ash-project/ash/security/advisories/GHSA-68q3-w4w3-2gfv

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Ash.Vector\u0027"
          ],
          "packageName": "ash",
          "packageURL": "pkg:hex/ash",
          "product": "ash",
          "programFiles": [
            "lib/ash/vector.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Ash.Vector\u0027:new/1"
            },
            {
              "name": "\u0027Elixir.Ash.Vector\u0027:from_binary/1"
            }
          ],
          "repo": "https://github.com/ash-project/ash",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "3.32.2",
              "status": "affected",
              "version": "2.14.13",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Ash.Vector\u0027"
          ],
          "packageName": "ash-project/ash",
          "packageURL": "pkg:github/ash-project/ash",
          "product": "ash",
          "programFiles": [
            "lib/ash/vector.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Ash.Vector\u0027:new/1"
            },
            {
              "name": "\u0027Elixir.Ash.Vector\u0027:from_binary/1"
            }
          ],
          "repo": "https://github.com/ash-project/ash",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "cef5eb7b0693f04d1699a36e02a4e09ce1e7bffe",
              "status": "affected",
              "version": "e2855843ca4a9141dcd7f40f47227e13b43f0e00",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements.\n\nAsh.Vector.new/1 (lib/ash/vector.ex) encodes a vector as \u003c\u003cdim::unsigned-16, 0::unsigned-16\u003e\u003e followed by the element floats, packing the element count into a 16-bit field without checking its range. A list of more than 65,535 elements wraps the dimension modulo 65,536, so the encoded header records a dimension that disagrees with the number of stored floats. from_binary/1 later reads binary-size(dim)-unit(32) from the wrapped header, so every read of the corrupted value misparses and raises, denying access to the affected record. The fix rejects any vector whose dimension exceeds 65,535.\n\nThis issue affects ash: from 2.14.13 before 3.32.2."
    }
  ],
  "id": "CVE-2026-82737",
  "lastModified": "2026-09-01T13:20:03.490",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-82737",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-01T12:55:44.794250Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-01T04:18:03.193",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://cna.erlef.org/cves/CVE-2026-82737.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/ash-project/ash/commit/cef5eb7b0693f04d1699a36e02a4e09ce1e7bffe"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/ash-project/ash/security/advisories/GHSA-68q3-w4w3-2gfv"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-82737"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/ash-project/ash/security/advisories/GHSA-68q3-w4w3-2gfv"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-82737 (GCVE-0-2026-82737)

FKIE_CVE-2026-82737

Tags

Sightings

Nomenclature