CVE-2026-49759

HIGH EPSS 36.5%
Published Jun 10, 20262w ago · Modified Jun 17, 20261w ago
8.8 CVSS 4.0
High
Find Similar
Published Jun 10, 2026 2w ago
Last Modified Jun 17, 2026 1w ago

Description

Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attacker to crash the BEAM VM by sending a crafted SCTP ERROR chunk. The sctp_parse_error_chunk function in erts/emulator/drivers/common/inet_drv.c parses SCTP ERROR chunks and writes cause codes into a fixed-size stack-allocated ErlDrvTermData spec[] array without checking bounds. A remote attacker who has established an SCTP association to a listening port can send a single crafted SCTP ERROR chunk containing enough cause codes to overflow the stack buffer, crashing the VM. The attacker can only write 16-bit values interleaved with a fixed tag, so the overflow does not provide a controlled return address, limiting exploitation to Denial of Service. A crafted SCTP ERROR chunk may also leak bits and pieces of Erlang VM memory into the received error packet observed by the Erlang process. Such data is already readable by the user running the Erlang VM, so the disclosure scope is limited. This issue affects OTP from OTP 17.0 before 27.3.4.13, 28.5.0.2 and 29.0.2, corresponding to erts from 6.0 before 15.2.7.9, 16.4.0.2 and 17.0.2.

CVSS Details

Base Score
8.8
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
36.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-121

Affected Products 6

VendorProductVersionRange
erlangerlang\/otp*≥17.0  –  <27.3.4.13
erlangerlang\/otp*≥28.0  –  <28.5.0.2
erlangerlang\/otp*≥29.0  –  <29.0.2
erlangerts*≥6.0  –  <15.2.7.9
erlangerts*≥16.0  –  <16.4.0.2
erlangerts*≥17.0  –  <17.0.2

References 5

  • cna.erlef.org https://cna.erlef.org/cves/CVE-2026-49759.html
    Third Party Advisory
  • github.com https://github.com/erlang/otp/commit/3983d495284331c121f600a80bac9fcf4e16381e
    Patch
  • github.com https://github.com/erlang/otp/security/advisories/GHSA-6f4f-chj5-5g97
    Vendor Advisory
  • osv.dev https://osv.dev/vulnerability/EEF-CVE-2026-49759
    Third Party Advisory
  • erlang.org https://www.erlang.org/doc/system/versions.html#order-of-versions
    Product

Remediation

  • github.com https://github.com/erlang/otp/commit/3983d495284331c121f600a80bac9fcf4e16381e
    Patch