SecuriTricks - CVE-2026-49759

Description

Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attacker to crash the BEAM VM by sending a crafted SCTP ERROR chunk. The sctp_parse_error_chunk function in erts/emulator/drivers/common/inet_drv.c parses SCTP ERROR chunks and writes cause codes into a fixed-size stack-allocated ErlDrvTermData spec[] array without checking bounds. A remote attacker who has established an SCTP association to a listening port can send a single crafted SCTP ERROR chunk containing enough cause codes to overflow the stack buffer, crashing the VM. The attacker can only write 16-bit values interleaved with a fixed tag, so the overflow does not provide a controlled return address, limiting exploitation to Denial of Service. A crafted SCTP ERROR chunk may also leak bits and pieces of Erlang VM memory into the received error packet observed by the Erlang process. Such data is already readable by the user running the Erlang VM, so the disclosure scope is limited. This issue affects OTP from OTP 17.0 before 27.3.4.13, 28.5.0.2 and 29.0.2, corresponding to erts from 6.0 before 15.2.7.9, 16.4.0.2 and 17.0.2.

Product(s) Impacted

Vendor	Product	Versions
Erlang	Otp Erts	17.0-27.3.4.13, 28.5.0.2, 29.0.2 6.0-15.2.7.9, 16.4.0.2, 17.0.2

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-121

Stack-based Buffer Overflow

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	erlang	otp	17.0-27.3.4.13	/	/	/	/	/	/	/
a	erlang	otp	28.5.0.2	/	/	/	/	/	/	/
a	erlang	otp	29.0.2	/	/	/	/	/	/	/
a	erlang	erts	6.0-15.2.7.9	/	/	/	/	/	/	/
a	erlang	erts	16.4.0.2	/	/	/	/	/	/	/
a	erlang	erts	17.0.2	/	/	/	/	/	/	/

References

https://cna.erlef.org/cves/CVE-2026-49759.html

https://github.com/erlang/otp/commit/3983d495284331c121f600a80bac9fcf4e16381e

https://github.com/erlang/otp/security/advisories/GHSA-6f4f-chj5-5g97

https://osv.dev/vulnerability/EEF-CVE-2026-49759

https://www.erlang.org/doc/system/versions.html#order-of-versions

CVSS Score

8.8 / 10

CVSS Data - 4.0

Attack Vector: NETWORK
Attack Complexity: LOW
Attack Requirements: NONE
Privileges Required: NONE
User Interaction: NONE
Scope:
Confidentiality Impact: LOW
Integrity Impact: NONE
Availability Impact: HIGH
Exploit Maturity: NOT_DEFINED

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

View Vector String

Timeline

Published: June 10, 2026, 4:17 p.m.
Last Modified: June 10, 2026, 8:19 p.m.

Status : Undergoing Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

6b3ad84c-e1a6-4bf7-a703-f496b71e49db

CVE-2026-49759