Stack-based Buffer Overflow in Erlang OTP Affects Multiple Versions

CVE-2026-49760

What is CVE-2026-49760?

The stack-based buffer overflow vulnerability in Erlang OTP's ei_s_print_term function can be triggered by passing an encoded Erlang term with an excessively large integer, exceeding the internal stack buffer limit of 2000 characters. This results in overflow, where the manipulated stack may lead to a Denial of Service. While this flaw affects specific versions of OTP and erl_interface, the companion function ei_print_term remains unaffected, as it does not utilize a fixed-size memory buffer. Users of impacted versions should apply patches immediately to mitigate potential risks.

References