Kiko Fernandez-Reyes

**Name of the Vulnerable Software and Affected Versions** Erlang OTP versions 25.0 through 27.3.4.14 Erlang OTP versions 28.0 through 28.5.0.3 Erlang OTP versions 29.0 through 29.0.3 **Description** A signed to unsigned conversion error leads to an out-of-bounds write when the system processes a crafted Erlang external term format (ETF) binary via the `binary to term/1` function. During the decoding of a `LARGE TUPLE EXT` term, the `decoded size()` function in `erts/emulator/beam/external.c` reads the 32-bit arity field as unsigned using `get uint32()`, whereas the `dec term()` function reads it as a signed 32-bit integer using `get int32()`. An arity value of `0x80000000` bypasses validation but is decoded as a negative number, causing the heap allocation pointer `hp` to move backward. Because the `MAX ARITYVAL` limit is not enforced, this results in an out-of-bounds heap write, which typically causes the virtual machine to detect an invalid heap size and abort, leading to a denial of service. **Recommendations** Update Erlang OTP to version 27.3.4.15 or later. Update Erlang OTP to version 28.5.0.4 or later. Update Erlang OTP to version 29.0.4 or later.