CVE-2026-49760: Stack Buffer Overflow in ei_s_print_term at Very Large Integer
Stack Buffer Overflow in eisprintterm at Very Large Integer
Other sources
Stack-based Buffer Overflow vulnerability in Erlang OTP (erlinterface) allows Stack-based Buffer Overflow.
This vulnerability is associated with program file lib/erlinterface/src/misc/eiprintterm.c and program routine eisprintterm.
The C function eisprintterm uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of 0-9 and A-F, which limits exploitation to Denial of Service.
The companion function eiprintterm, which prints directly to a FILE instead of a memory buffer, does not contain this bug.
This issue affects OTP from OTP 17.0 before OTP 29.0.2, OTP 28.5.0.2 and OTP 27.3.4.13, corresponding to erlinterface from 3.7.16 before 5.8.1, 5.7.0.1 and 5.5.2.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.2.5.21-2 - Upgrade
Upgrade
erl_interface (ei_s_print_term / ei_printterm.c)to a version that resolves this vulnerability.Fixed in 5.8.1 - Upgrade
Upgrade
erl_interface (ei_s_print_term / ei_printterm.c)to a version that resolves this vulnerability.Fixed in 5.7.0.1 - Upgrade
Upgrade
erl_interface (ei_s_print_term / ei_printterm.c)to a version that resolves this vulnerability.Fixed in 5.5.2.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49760?
CVE-2026-49760 has a medium severity rating of 6.9.
What is CVE-2026-49760?
CVE-2026-49760 is a stack-based buffer overflow vulnerability in the ei_s_print_term function of Erlang OTP.
How do I fix CVE-2026-49760?
To fix CVE-2026-49760, update to the latest version of Erlang OTP that addresses this vulnerability.
Who is affected by CVE-2026-49760?
CVE-2026-49760 affects users of Erlang OTP that utilize the erl_interface library.
What are the potential impacts of CVE-2026-49760?
The potential impacts of CVE-2026-49760 include the possibility of arbitrary code execution due to the buffer overflow.