Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow.
This vulnerability is associated with program file lib/erl_interface/src/misc/ei_printterm.c and program routine ei_s_print_term.
The C function ei_s_print_term uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of 0-9 and A-F, which limits exploitation to Denial of Service.
The companion function ei_print_term, which prints directly to a FILE instead of a memory buffer, does not contain this bug.
This issue affects OTP from OTP 17.0 before OTP 29.0.2, OTP 28.5.0.2 and OTP 27.3.4.13, corresponding to erl_interface from 3.7.16 before 5.8.1, 5.7.0.1 and 5.5.2.1.
References
| Link | Resource |
|---|---|
| https://cna.erlef.org/cves/CVE-2026-49760.html | Mitigation Third Party Advisory |
| https://github.com/erlang/otp/commit/0bef277b2d39dc8babb9ceb4f5d0a456f3007111 | Patch |
| https://github.com/erlang/otp/security/advisories/GHSA-xcxj-5pg2-v72j | Mitigation Vendor Advisory |
| https://osv.dev/vulnerability/EEF-CVE-2026-49760 | Mitigation Third Party Advisory |
| https://www.erlang.org/doc/system/versions.html#order-of-versions | Product |
Configurations
Configuration 1 (hide)
|
History
24 Jul 2026, 15:17
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow. This vulnerability is associated with program file lib/erl_interface/src/misc/ei_printterm.c and program routine ei_s_print_term. The C function ei_s_print_term uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of 0-9 and A-F, which limits exploitation to Denial of Service. The companion function ei_print_term, which prints directly to a FILE instead of a memory buffer, does not contain this bug. This issue affects OTP from OTP 17.0 before OTP 29.0.2, OTP 28.5.0.2 and OTP 27.3.4.13, corresponding to erl_interface from 3.7.16 before 5.8.1, 5.7.0.1 and 5.5.2.1. |
15 Jun 2026, 18:23
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| First Time |
Erlang erlang\/otp
Erlang Erlang erl Interface |
|
| CPE | cpe:2.3:a:erlang:erl_interface:*:*:*:*:*:*:*:* cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* |
|
| References | () https://cna.erlef.org/cves/CVE-2026-49760.html - Mitigation, Third Party Advisory | |
| References | () https://github.com/erlang/otp/commit/0bef277b2d39dc8babb9ceb4f5d0a456f3007111 - Patch | |
| References | () https://github.com/erlang/otp/security/advisories/GHSA-xcxj-5pg2-v72j - Mitigation, Vendor Advisory | |
| References | () https://osv.dev/vulnerability/EEF-CVE-2026-49760 - Mitigation, Third Party Advisory | |
| References | () https://www.erlang.org/doc/system/versions.html#order-of-versions - Product |
10 Jun 2026, 16:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-10 16:17
Updated : 2026-07-24 15:17
NVD link : CVE-2026-49760
Mitre link : CVE-2026-49760
CVE.ORG link : CVE-2026-49760
JSON object : View
Products Affected
erlang
- erl_interface
- erlang\/otp
CWE
CWE-121
Stack-based Buffer Overflow