TI-2021-10051 Aliases CVE-2021-29221 GHSA-gq7g-854q-935r

Untrusted search path in Erlang/OTP

LOW 32CWE-426Published 2021-04-09 · Updated 2024-08-03

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-426.

Summary

A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3. By adding files to an existing installation's directory, a local attacker could hijack accounts of other users running Erlang programs or possibly coerce a service running with "erlsrv.exe" to execute arbitrary code as Local System. This can occur only under specific conditions on Windows with unsafe filesystem permissions.

Why it matters now

EPSS 0.00584 48th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Erlang/OTP (Erlang Project): 23.2.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Erlang Project	Erlang/OTP	before 23.2.3	23.2.3	Patch available	CNA

Erlang/OTP VendorErlang Project Affected before 23.2.3 Fixed in 23.2.3 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:erlang:erlang\/otp::::::::	before 23.2.3	Vulnerable	Erlang
cpe:2.3:o:microsoft:windows:-:::::::*	not specified by NVD	Running on	Microsoft

cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* Versions before 23.2.3 Vulnerable ·Erlang
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

Fix · CNA Erlang/OTP (Erlang Project) Fixed in 23.2.3

Timeline

2026-10-02 Threatist record created from CVE-2021-29221
2026-10-03 Alias added: GHSA-gq7g-854q-935r

References

Exploit 1

https://deepsurface.com/deepsurface-security-advisory-local-privilege-escalation-in-erlang-on-windows-cve-2021-29221/

Advisory 1

https://github.com/erlang/otp/releases/tag/OTP-23.2.3

TI-2025-23504 Erlang/OTP SSH Vulnerable to Pre-Authentication RCE KEVCVSS 3.1CRITICAL 10.0
TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
TI-2017-14604 The Erlang otp TLS server answers with different TLS alerts to different error types in… CVSS 3.0MEDIUM 5.9
TI-2026-36669 Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash CVSS 4.0HIGH 8.8
TI-2022-17230 In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a… CVSS 3.1CRITICAL 9.8
TI-2016-08327 An issue was discovered in Erlang/OTP 18.x. CVSS 3.0CRITICAL 9.8

See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences