PT-2026-84086 · Ash · Ash
CVSS v4.0
5.9
Medium
| Vector | AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
ash versions 2.14.13 through 3.32.1
Description
An integer overflow occurs when submitting a vector with more than 65,535 elements. The
Ash.Vector.new/1 function in lib/ash/vector.ex packs the element count into a 16-bit field without range validation, causing the dimension to wrap modulo 65,536. This results in an encoded header that disagrees with the number of stored floats. Subsequently, the from binary/1 function reads the binary size based on this wrapped header, leading to parsing failures and crashes that deny access to the affected record.Recommendations
Update to version 3.32.2 or later.
Exploit
Fix
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ash