Erlang OTP ei_printterm.c stack-based overflow

Summaryinfo

A vulnerability, which was classified as critical, was found in Erlang OTP. Affected is an unknown function in the library lib/erl_interface/src/misc/ei_printterm.c. Executing a manipulation can lead to stack-based overflow. The identification of this vulnerability is CVE-2026-49760. The attack can only be executed locally. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Erlang OTP (affected version not known). It has been declared as critical. This vulnerability affects some unknown functionality in the library lib/erl_interface/src/misc/ei_printterm.c. The manipulation with an unknown input leads to a stack-based overflow vulnerability. The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow. This vulnerability is associated with program file lib/erl_interface/src/misc/ei_printterm.c and program routine ei_s_print_term. The C function ei_s_print_term uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of 0-9 and A-F, which limits exploitation to Denial of Service. The companion function ei_print_term, which prints directly to a FILE instead of a memory buffer, does not contain this bug. This issue affects OTP from OTP 17.0 before 27.3.4.13, 28.5.0.2 and 29.0.2, corresponding to erl_interface from 3.7.16 before 5.5.2.1, 5.7.0.1 and 5.8.1.

The weakness was shared by Jonatan Männchen as GHSA-xcxj-5pg2-v72j. The advisory is shared for download at github.com. This vulnerability was named CVE-2026-49760 since 06/01/2026. The exploitation appears to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available.

Upgrading eliminates this vulnerability. Applying the patch 0bef277b2d39dc8babb9ceb4f5d0a456f3007111 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Erlang

Name

• OTP

License

• open-source

Website

• Product: https://github.com/erlang/otp/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion