PT-2026-64990 · Unknown · Erlang/Otp
CVSS v4.0
8.3
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Erlang/OTP versions prior to 29.0.4
Erlang/OTP versions prior to 28.5.0.4
Erlang/OTP versions prior to 27.3.4.15
Description
A buffer overflow exists in the megaco flex scanner C driver. A remote unauthenticated attacker can corrupt the driver's memory by sending a text-encoded H.248/Megaco message containing an oversized property parm name. During the tokenization of a Local/Remote descriptor, the
mfs load property groups() function extracts the property name and formats it into a fixed 512-byte error msg field of the MfsErlDrvData struct using an unchecked sprintf call. Names exceeding approximately 452 bytes overflow into adjacent struct fields, including text buf, text ptr, term spec, term spec size, and term spec index. This allows the attacker to overwrite pointers and counters, potentially leading to arbitrary write and free primitives within the BEAM VM process, which can result in remote code execution. On builds compiled with FORTIFY SOURCE, the overflow triggers a SIGABRT, causing a denial of service. The issue occurs before authentication processing and requires the node to be configured with {scanner, flex}.Recommendations
Update Erlang/OTP to version 29.0.4 or later.
Update Erlang/OTP to version 28.5.0.4 or later.
Update Erlang/OTP to version 27.3.4.15 or later.
As a temporary workaround, switch the megaco text codec to the default Erlang-based scanner by removing
{scanner, flex} from the encoder configuration.Fix
Buffer Overflow
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Erlang/Otp