Read the docs
TI-2026-36670 Aliases CVE-2026-49760

Stack Buffer Overflow in ei_s_print_term at Very Large Integer

Priority LOW 29CWE-121Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow. This vulnerability is associated with program file lib/erl_interface/src/misc/ei_printterm.c and program routine ei_s_print_term. The C function ei_s_print_term uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of 0-9 and A-F, which limits exploitation to Denial of Service. The companion function ei_print_term, which prints directly to a FILE instead of a memory buffer, does not contain this bug. This issue affects OTP from OTP 17.0 before OTP 27.3.4.13, OTP 28.5.0.2, and OTP 29.0.2, corresponding to erl_interface from 3.7.16 before 5.5.2.1, 5.7.0.1, and 5.8.1. Whether OTP before OTP 17.0, corresponding to erl_interface before 3.7.16, is affected is unknown.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00136 3rd percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ErlangOTP17.0 and later—No fix listedCNA
ErlangOTP3.7.16 and later—No fix listedCNA
  • OTP VendorErlang Affected 17.0 and later Fixed in — No fix listed CNA
  • OTP VendorErlang Affected 3.7.16 and later Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:erlang:erl_interface:*:*:*:*:*:*:*:*3.7.16 to before 5.5.2.1; 5.7 to before 5.7.0.1; 5.8 to before 5.8.1VulnerableErlang
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*17.0 to before 27.3.4.13; 28.0 to before 28.5.0.2; 29.0 to before 29.0.2VulnerableErlang
  • cpe:2.3:a:erlang:erl_interface:*:*:*:*:*:*:*:* Versions 3.7.16 to before 5.5.2.1; 5.7 to before 5.7.0.1; 5.8 to before 5.8.1 Vulnerable ·Erlang
  • cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* Versions 17.0 to before 27.3.4.13; 28.0 to before 28.5.0.2; 29.0 to before 29.0.2 Vulnerable ·Erlang

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49760

References

Patch 1

Advisory 3

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences