Out-of-bounds Write Vulnerability in Erlang OTP by Erlang Solutions

CVE-2026-55737

What is CVE-2026-55737?

An out-of-bounds write vulnerability exists in Erlang OTP that arises from a signed to unsigned conversion error and improper validation when decoding certain Erlang external term format (ETF) binaries. This flaw allows an attacker to craft malicious input that can cause heap corruption, ultimately leading to a virtual machine crash. Specifically, the vulnerability stems from a discrepancy in how the arity field is interpreted during the validation and decoding processes, allowing attackers to bypass runtime checks. This impacts various versions of OTP, requiring immediate attention from affected users.

References