← Back to CVE Explorer

CVE-2026-49760

Full vulnerability record from the local CVENow database.

Description

Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow. This vulnerability is associated with program file lib/erl_interface/src/misc/ei_printterm.c and program routine ei_s_print_term. The C function ei_s_print_term uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of 0-9 and A-F, which limits exploitation to Denial of Service. The companion function ei_print_term, which prints directly to a FILE instead of a memory buffer, does not contain this bug. This issue affects OTP from OTP 17.0 before OTP 27.3.4.13, OTP 28.5.0.2, and OTP 29.0.2, corresponding to erl_interface from 3.7.16 before 5.5.2.1, 5.7.0.1, and 5.8.1. Whether OTP before OTP 17.0, corresponding to erl_interface before 3.7.16, is affected is unknown.

Severity
MEDIUM
CVSS score
6.9 (v4.0)
Vulnerability status
Modified
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-06-10 16:17:12.947000
Last modified
2026-10-26 11:10:00.157000
View original CVE JSON 
{
  "id": "CVE-2026-49760",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "published": "2026-06-10T16:17:12.947",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow.\n\nThis vulnerability is associated with program file lib/erl_interface/src/misc/ei_printterm.c and program routine ei_s_print_term.\n\nThe C function ei_s_print_term uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of 0-9 and A-F, which limits exploitation to Denial of Service.\n\nThe companion function ei_print_term, which prints directly to a FILE instead of a memory buffer, does not contain this bug.\n\nThis issue affects OTP from OTP 17.0 before OTP 27.3.4.13, OTP 28.5.0.2, and OTP 29.0.2, corresponding to erl_interface from 3.7.16 before 5.5.2.1, 5.7.0.1, and 5.8.1. Whether OTP before OTP 17.0, corresponding to erl_interface before 3.7.16, is affected is unknown."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de desbordamiento de búfer basado en pila en Erlang OTP (erl_interface) permite desbordamiento de búfer basado en pila.\n\nEsta vulnerabilidad está asociada con el archivo de programa lib/erl_interface/src/misc/ei_printterm.c y la rutina de programa ei_s_print_term.\n\nLa función C ei_s_print_term utiliza un búfer de pila interno de 2000 caracteres para formatear términos. Cuando se llama con un término Erlang codificado que contiene un entero muy grande (representación codificada que excede los 2000 caracteres), el búfer se desborda. Los bytes desbordados están restringidos a los valores ASCII de 0-9 y A-F, lo que limita la explotación a denegación de servicio.\n\nLa función compañera ei_print_term, que imprime directamente a un FILE en lugar de un búfer de memoria, no contiene este error.\n\nEste problema afecta a OTP desde OTP 17.0 antes de 27.3.4.13, 28.5.0.2 y 29.0.2, correspondiente a erl_interface desde 3.7.16 antes de 5.5.2.1, 5.7.0.1 y 5.8.1."
    }
  ],
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "vendor": "Erlang",
          "product": "OTP",
          "defaultStatus": "unknown",
          "packageName": "otp",
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "erl_interface"
          ],
          "programFiles": [
            "lib/erl_interface/src/misc/ei_printterm.c"
          ],
          "programRoutines": [
            {
              "name": "ei_s_print_term"
            }
          ],
          "packageURL": "pkg:software-id/erlang.org/otp",
          "versions": [
            {
              "version": "17.0",
              "lessThan": "*",
              "versionType": "otp",
              "status": "affected",
              "changes": [
                {
                  "at": "27.3.4.13",
                  "status": "unaffected"
                },
                {
                  "at": "28.5.0.2",
                  "status": "unaffected"
                },
                {
                  "at": "29.0.2",
                  "status": "unaffected"
                }
              ]
            }
          ]
        },
        {
          "vendor": "Erlang",
          "product": "OTP",
          "defaultStatus": "unknown",
          "packageName": "erl_interface",
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "erl_interface"
          ],
          "programFiles": [
            "src/misc/ei_printterm.c"
          ],
          "programRoutines": [
            {
              "name": "ei_s_print_term"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "packageURL": "pkg:otp/erl_interface?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
          "versions": [
            {
              "version": "3.7.16",
              "lessThan": "*",
              "versionType": "otp",
              "status": "affected",
              "changes": [
                {
                  "at": "5.5.2.1",
                  "status": "unaffected"
                },
                {
                  "at": "5.7.0.1",
                  "status": "unaffected"
                },
                {
                  "at": "5.8.1",
                  "status": "unaffected"
                }
              ]
            }
          ]
        },
        {
          "vendor": "Erlang",
          "product": "OTP",
          "defaultStatus": "unknown",
          "collectionURL": "https://github.com",
          "packageName": "erlang/otp",
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "erl_interface"
          ],
          "programFiles": [
            "lib/erl_interface/src/misc/ei_printterm.c"
          ],
          "programRoutines": [
            {
              "name": "ei_s_print_term"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "packageURL": "pkg:github/erlang/otp",
          "versions": [
            {
              "version": "84adefa331c4159d432d22840663c38f155cd4c1",
              "lessThan": "0bef277b2d39dc8babb9ceb4f5d0a456f3007111",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "0bef277b2d39dc8babb9ceb4f5d0a456f3007111",
              "lessThan": "*",
              "versionType": "git",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-10T16:16:14.697009Z",
          "id": "CVE-2026-49760",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:erlang:erl_interface:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.7.16",
              "versionEndExcluding": "5.5.2.1",
              "matchCriteriaId": "BC41283B-463D-427D-AF2F-AAA70D1F29FD"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:erlang:erl_interface:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.7",
              "versionEndExcluding": "5.7.0.1",
              "matchCriteriaId": "675D56C9-DBC3-4D8B-9599-5DC5677BA93B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:erlang:erl_interface:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.8",
              "versionEndExcluding": "5.8.1",
              "matchCriteriaId": "2C3C2FDD-D25E-4290-8AA3-40EA8793CE59"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "17.0",
              "versionEndExcluding": "27.3.4.13",
              "matchCriteriaId": "BF42A5F2-4C27-43FE-B5FA-17A3422B9649"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "28.0",
              "versionEndExcluding": "28.5.0.2",
              "matchCriteriaId": "902ED4C3-B9DE-4ABC-9BEA-D23DA4F5D373"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "29.0",
              "versionEndExcluding": "29.0.2",
              "matchCriteriaId": "F4AB1573-4E81-4338-B65A-B3C94C7249FA"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-49760.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/erlang/otp/commit/0bef277b2d39dc8babb9ceb4f5d0a456f3007111",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/erlang/otp/security/advisories/GHSA-xcxj-5pg2-v72j",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-49760",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "tags": [
        "Product"
      ]
    }
  ]
}