PT-2026-64987 · Unknown · Erlang/Otp
CVSS v4.0
5.1
Medium
| Vector | AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Erlang OTP versions 25.0 through 27.3.4.14
Erlang OTP versions 28.0 through 28.5.0.3
Erlang OTP versions 29.0 through 29.0.3
Description
A signed to unsigned conversion error leads to an out-of-bounds write when the system processes a crafted Erlang external term format (ETF) binary via the
binary to term/1 function. During the decoding of a LARGE TUPLE EXT term, the decoded size() function in erts/emulator/beam/external.c reads the 32-bit arity field as unsigned using get uint32(), whereas the dec term() function reads it as a signed 32-bit integer using get int32(). An arity value of 0x80000000 bypasses validation but is decoded as a negative number, causing the heap allocation pointer hp to move backward. Because the MAX ARITYVAL limit is not enforced, this results in an out-of-bounds heap write, which typically causes the virtual machine to detect an invalid heap size and abort, leading to a denial of service.Recommendations
Update Erlang OTP to version 27.3.4.15 or later.
Update Erlang OTP to version 28.5.0.4 or later.
Update Erlang OTP to version 29.0.4 or later.
Fix
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Erlang/Otp