CVE-2026-49760

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-49760
Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow. This vulnerability is associated with program file lib/erl_interface/src/misc/ei_printterm.c and program routine ei_s_print_term. The C function ei_s_print_term uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of 0-9 and A-F, which limits exploitation to Denial of Service. The companion function ei_print_term, which prints directly to a FILE instead of a memory buffer, does not contain this bug. This issue affects OTP from OTP 17.0 before OTP 27.3.4.13, OTP 28.5.0.2, and OTP 29.0.2, corresponding to erl_interface from 3.7.16 before 5.5.2.1, 5.7.0.1, and 5.8.1. Whether OTP before OTP 17.0, corresponding to erl_interface before 3.7.16, is affected is unknown.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://cna.erlef.org/cves/CVE-2026-49760.html Mitigation Third Party Advisory
https://github.com/erlang/otp/commit/0bef277b2d39dc8babb9ceb4f5d0a456f3007111 Patch
https://github.com/erlang/otp/security/advisories/GHSA-xcxj-5pg2-v72j Mitigation Vendor Advisory
https://osv.dev/vulnerability/EEF-CVE-2026-49760 Mitigation Third Party Advisory
https://www.erlang.org/doc/system/versions.html#order-of-versions Product
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:erlang:erl_interface:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erl_interface:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erl_interface:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
History

26 Oct 2026, 11:10

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de desbordamiento de búfer basado en pila en Erlang OTP (erl_interface) permite desbordamiento de búfer basado en pila. Esta vulnerabilidad está asociada con el archivo de programa lib/erl_interface/src/misc/ei_printterm.c y la rutina de programa ei_s_print_term. La función C ei_s_print_term utiliza un búfer de pila interno de 2000 caracteres para formatear términos. Cuando se llama con un término Erlang codificado que contiene un entero muy grande (representación codificada que excede los 2000 caracteres), el búfer se desborda. Los bytes desbordados están restringidos a los valores ASCII de 0-9 y A-F, lo que limita la explotación a denegación de servicio. La función compañera ei_print_term, que imprime directamente a un FILE en lugar de un búfer de memoria, no contiene este error. Este problema afecta a OTP desde OTP 17.0 antes de 27.3.4.13, 28.5.0.2 y 29.0.2, correspondiente a erl_interface desde 3.7.16 antes de 5.5.2.1, 5.7.0.1 y 5.8.1.

24 Sep 2026, 21:17

Type Values Removed Values Added
Summary (en) Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow. This vulnerability is associated with program file lib/erl_interface/src/misc/ei_printterm.c and program routine ei_s_print_term. The C function ei_s_print_term uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of 0-9 and A-F, which limits exploitation to Denial of Service. The companion function ei_print_term, which prints directly to a FILE instead of a memory buffer, does not contain this bug. This issue affects OTP from OTP 17.0 before OTP 29.0.2, OTP 28.5.0.2 and OTP 27.3.4.13, corresponding to erl_interface from 3.7.16 before 5.8.1, 5.7.0.1 and 5.5.2.1. (en) Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow. This vulnerability is associated with program file lib/erl_interface/src/misc/ei_printterm.c and program routine ei_s_print_term. The C function ei_s_print_term uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of 0-9 and A-F, which limits exploitation to Denial of Service. The companion function ei_print_term, which prints directly to a FILE instead of a memory buffer, does not contain this bug. This issue affects OTP from OTP 17.0 before OTP 27.3.4.13, OTP 28.5.0.2, and OTP 29.0.2, corresponding to erl_interface from 3.7.16 before 5.5.2.1, 5.7.0.1, and 5.8.1. Whether OTP before OTP 17.0, corresponding to erl_interface before 3.7.16, is affected is unknown.
Information

Published : 2026-06-10 16:17

Updated : 2026-10-26 11:10

NVD link : CVE-2026-49760

Mitre link : CVE-2026-49760

CVE.ORG link : CVE-2026-49760

JSON object : View

Products Affected

erlang

  • erl_interface
  • erlang\/otp
CWE
CWE-121

Stack-based Buffer Overflow