TI-2026-57055 Aliases CVE-2026-82737

Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads

MEDIUM 60CWE-190Published 2026-09-01 · Updated 2026-09-01

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: None · Low · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements. Ash.Vector.new/1 (lib/ash/vector.ex) encodes a vector as <<dim::unsigned-16, 0::unsigned-16>> followed by the element floats, packing the element count into a 16-bit field without checking its range. A list of more than 65,535 elements wraps the dimension modulo 65,536, so the encoded header records a dimension that disagrees with the number of stored floats. from_binary/1 later reads binary-size(dim)-unit(32) from the wrapped header, so every read of the corrupted value misparses and raises, denying access to the affected record. The fix rejects any vector whose dimension exceeds 65,535. This issue affects ash: from 2.14.13 before 3.32.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0018 7th percentileScored 2026-11-07

Fix Fixed ash (ash-project): 3.32.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ash-project	ash	2.14.13 to before 3.32.2	3.32.2	Patch available	CNA

ash Vendorash-project Affected 2.14.13 to before 3.32.2 Fixed in 3.32.2 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:ash-project:ash::::::::	—	—	—

cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA ash (ash-project) Fixed in 3.32.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-09-01
ash-project ash 3.32.2
16 records Highest priority Priority MEDIUM 15 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-57067 Incorrect authorization in ash-project ashPriority MEDIUM 60
- TI-2026-57065 Ash.Policy.Authorizer returns records denied by a runtime read policy to any actorPriority MEDIUM 60
- TI-2026-57064 Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden recordsPriority MEDIUM 60
Show all 16 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-82737

References

Patch 1

https://github.com/ash-project/ash/commit/cef5eb7b0693f04d1699a36e02a4e09ce1e7bffe

Advisory 1

https://github.com/ash-project/ash/security/advisories/GHSA-68q3-w4w3-2gfv

Other 2

TI-2026-56298 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service CVSS 4.0HIGH 8.7
TI-2026-52572 Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter CVSS 4.0HIGH 8.7
TI-2026-57010 Path traversal in AshAdmin file uploads via unsanitized client filename CVSS 4.0HIGH 8.3
TI-2026-26840 Ash Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash CVSS 4.0HIGH 8.2
TI-2026-54252 EEx template evaluation of prompt content in AshAi enables remote code execution CVSS 4.0HIGH 8.9
TI-2026-54208 Stored XSS in AshAdmin relationship typeahead via unescaped label_field content CVSS 4.0HIGH 8.4

See all 90 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences