CVE-2026-49760 Details

A stack-based buffer overflow vulnerability has been identified in the Erlang OTP library, specifically within the erl_interface component. This issue arises in versions 17.0 prior to 27.3.4.13, 28.5.0.2, and 29.0.2, corresponding to erl_interface versions 3.7.16 prior to 5.5.2.1, 5.7.0.1, and 5.8.1. The vulnerability occurs in the C function ei_s_print_term, which uses a 2000-character stack buffer to format terms. When the function is called with an encoded Erlang term containing a very large integer—specifically, an encoded representation exceeding 2000 characters—the buffer overflows. The overflow is limited to ASCII values 0-9 and A-F, restricting the exploitation potential to a denial-of-service condition. In contrast, the related function ei_print_term, which outputs directly to a file rather than a memory buffer, does not have this vulnerability.

Users can upgrade to Erlang OTP versions 27.3.4.13, 28.5.0.2, or 29.0.2 to address this vulnerability. For those using an affected version of the erl_interface component, upgrading to version 5.5.2.1, 5.7.0.1, or 5.8.1 is recommended.