CVE-2026-49760

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49760", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-06-01T13:45:22.449Z", "datePublished": "2026-06-10T14:35:36.804Z", "dateUpdated": "2026-09-24T20:42:47.418Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["erl_interface"], "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "programFiles": ["lib/erl_interface/src/misc/ei_printterm.c"], "programRoutines": [{"name": "ei_s_print_term"}], "vendor": "Erlang", "versions": [{"changes": [{"at": "27.3.4.13", "status": "unaffected"}, {"at": "28.5.0.2", "status": "unaffected"}, {"at": "29.0.2", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["erl_interface"], "packageName": "erl_interface", "packageURL": "pkg:otp/erl_interface?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": ["src/misc/ei_printterm.c"], "programRoutines": [{"name": "ei_s_print_term"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "5.5.2.1", "status": "unaffected"}, {"at": "5.7.0.1", "status": "unaffected"}, {"at": "5.8.1", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "3.7.16", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["erl_interface"], "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "programFiles": ["lib/erl_interface/src/misc/ei_printterm.c"], "programRoutines": [{"name": "ei_s_print_term"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"lessThan": "0bef277b2d39dc8babb9ceb4f5d0a456f3007111", "status": "affected", "version": "84adefa331c4159d432d22840663c38f155cd4c1", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "0bef277b2d39dc8babb9ceb4f5d0a456f3007111", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "27.3.4.13", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "28.5.0.2", "versionStartIncluding": "28.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "29.0.2", "versionStartIncluding": "29.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Jonatan M\u00e4nnchen / EEF"}, {"lang": "en", "type": "remediation developer", "value": "Sverker Eriksson"}], "datePublic": "2026-06-10T14:35:36.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow.</p>\n<p>This vulnerability is associated with program file <code>lib/erl_interface/src/misc/ei_printterm.c</code> and program routine <code>ei_s_print_term</code>.</p>\n<p>The C function <code>ei_s_print_term</code> uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of <code>0</code>-<code>9</code> and <code>A</code>-<code>F</code>, which limits exploitation to Denial of Service.</p>\n<p>The companion function <code>ei_print_term</code>, which prints directly to a <code>FILE</code> instead of a memory buffer, does not contain this bug.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;27.3.4.13, OTP&nbsp;28.5.0.2, and OTP&nbsp;29.0.2, corresponding to erl_interface from 3.7.16 before 5.5.2.1, 5.7.0.1, and 5.8.1. Whether OTP before OTP&nbsp;17.0, corresponding to erl_interface before 3.7.16, is affected is unknown.</p>"}, {"base64": false, "type": "text/markdown", "value": "Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow.\n\nThis vulnerability is associated with program file `lib/erl_interface/src/misc/ei_printterm.c` and program routine `ei_s_print_term`.\n\nThe C function `ei_s_print_term` uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of `0`-`9` and `A`-`F`, which limits exploitation to Denial of Service.\n\nThe companion function `ei_print_term`, which prints directly to a `FILE` instead of a memory buffer, does not contain this bug.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.13, OTP\u00a028.5.0.2, and OTP\u00a029.0.2, corresponding to erl_interface from 3.7.16 before 5.5.2.1, 5.7.0.1, and 5.8.1. Whether OTP before OTP\u00a017.0, corresponding to erl_interface before 3.7.16, is affected is unknown."}], "value": "Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow.\n\nThis vulnerability is associated with program file lib/erl_interface/src/misc/ei_printterm.c and program routine ei_s_print_term.\n\nThe C function ei_s_print_term uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of 0-9 and A-F, which limits exploitation to Denial of Service.\n\nThe companion function ei_print_term, which prints directly to a FILE instead of a memory buffer, does not contain this bug.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.13, OTP\u00a028.5.0.2, and OTP\u00a029.0.2, corresponding to erl_interface from 3.7.16 before 5.5.2.1, 5.7.0.1, and 5.8.1. Whether OTP before OTP\u00a017.0, corresponding to erl_interface before 3.7.16, is affected is unknown."}], "impacts": [{"capecId": "CAPEC-8", "descriptions": [{"lang": "en", "value": "CAPEC-8 Buffer Overflow in an API Call"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-09-24T20:42:47.418Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-xcxj-5pg2-v72j"}, {"name": "EEF CNA record for CVE-2026-49760", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-49760.html"}, {"name": "OSV record EEF-CVE-2026-49760", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-49760"}, {"name": "Erlang/OTP version ordering", "tags": ["x_version-scheme"], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}, {"name": "Fix commit 0bef277 in erlang/otp", "tags": ["patch"], "url": "https://github.com/erlang/otp/commit/0bef277b2d39dc8babb9ceb4f5d0a456f3007111"}], "source": {"discovery": "INTERNAL"}, "title": "Stack Buffer Overflow in ei_s_print_term at Very Large Integer", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Avoid calling <code>ei_s_print_term</code> with untrusted data whose encoded integer representation could exceed 2000 characters.</p>"}, {"base64": false, "type": "text/markdown", "value": "Avoid calling `ei_s_print_term` with untrusted data whose encoded integer representation could exceed 2000 characters."}], "value": "Avoid calling ei_s_print_term with untrusted data whose encoded integer representation could exceed 2000 characters."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-10T16:16:14.697009Z", "id": "CVE-2026-49760", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-10T16:16:28.366Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-49760", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T16:16:14.697009Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-10T16:16:22.977Z"}}], "cna": {"title": "Stack Buffer Overflow in ei_s_print_term at Very Large Integer", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Jonatan M\u00e4nnchen / EEF"}, {"lang": "en", "type": "remediation developer", "value": "Sverker Eriksson"}], "impacts": [{"capecId": "CAPEC-8", "descriptions": [{"lang": "en", "value": "CAPEC-8 Buffer Overflow in an API Call"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "vendor": "Erlang", "modules": ["erl_interface"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "27.3.4.13", "status": "unaffected"}, {"at": "28.5.0.2", "status": "unaffected"}, {"at": "29.0.2", "status": "unaffected"}], "version": "17.0", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:software-id/erlang.org/otp", "packageName": "otp", "programFiles": ["lib/erl_interface/src/misc/ei_printterm.c"], "defaultStatus": "unknown", "programRoutines": [{"name": "ei_s_print_term"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["erl_interface"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "5.5.2.1", "status": "unaffected"}, {"at": "5.7.0.1", "status": "unaffected"}, {"at": "5.8.1", "status": "unaffected"}], "version": "3.7.16", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:otp/erl_interface?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "packageName": "erl_interface", "programFiles": ["src/misc/ei_printterm.c"], "defaultStatus": "unknown", "programRoutines": [{"name": "ei_s_print_term"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["erl_interface"], "product": "OTP", "versions": [{"status": "affected", "version": "84adefa331c4159d432d22840663c38f155cd4c1", "lessThan": "0bef277b2d39dc8babb9ceb4f5d0a456f3007111", "versionType": "git"}, {"status": "unaffected", "version": "0bef277b2d39dc8babb9ceb4f5d0a456f3007111", "lessThan": "*", "versionType": "git"}], "packageURL": "pkg:github/erlang/otp", "packageName": "erlang/otp", "programFiles": ["lib/erl_interface/src/misc/ei_printterm.c"], "collectionURL": "https://github.com", "defaultStatus": "unknown", "programRoutines": [{"name": "ei_s_print_term"}]}], "datePublic": "2026-06-10T14:35:36.000Z", "references": [{"url": "https://github.com/erlang/otp/security/advisories/GHSA-xcxj-5pg2-v72j", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-49760.html", "name": "EEF CNA record for CVE-2026-49760", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-49760", "name": "OSV record EEF-CVE-2026-49760", "tags": ["related"]}, {"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions", "name": "Erlang/OTP version ordering", "tags": ["x_version-scheme"]}, {"url": "https://github.com/erlang/otp/commit/0bef277b2d39dc8babb9ceb4f5d0a456f3007111", "name": "Fix commit 0bef277 in erlang/otp", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "Avoid calling ei_s_print_term with untrusted data whose encoded integer representation could exceed 2000 characters.", "supportingMedia": [{"type": "text/html", "value": "<p>Avoid calling <code>ei_s_print_term</code> with untrusted data whose encoded integer representation could exceed 2000 characters.</p>", "base64": false}, {"type": "text/markdown", "value": "Avoid calling `ei_s_print_term` with untrusted data whose encoded integer representation could exceed 2000 characters.", "base64": false}]}], "descriptions": [{"lang": "en", "value": "Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow.\n\nThis vulnerability is associated with program file lib/erl_interface/src/misc/ei_printterm.c and program routine ei_s_print_term.\n\nThe C function ei_s_print_term uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of 0-9 and A-F, which limits exploitation to Denial of Service.\n\nThe companion function ei_print_term, which prints directly to a FILE instead of a memory buffer, does not contain this bug.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.13, OTP\u00a028.5.0.2, and OTP\u00a029.0.2, corresponding to erl_interface from 3.7.16 before 5.5.2.1, 5.7.0.1, and 5.8.1. Whether OTP before OTP\u00a017.0, corresponding to erl_interface before 3.7.16, is affected is unknown.", "supportingMedia": [{"type": "text/html", "value": "<p>Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow.</p>\n<p>This vulnerability is associated with program file <code>lib/erl_interface/src/misc/ei_printterm.c</code> and program routine <code>ei_s_print_term</code>.</p>\n<p>The C function <code>ei_s_print_term</code> uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of <code>0</code>-<code>9</code> and <code>A</code>-<code>F</code>, which limits exploitation to Denial of Service.</p>\n<p>The companion function <code>ei_print_term</code>, which prints directly to a <code>FILE</code> instead of a memory buffer, does not contain this bug.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;27.3.4.13, OTP&nbsp;28.5.0.2, and OTP&nbsp;29.0.2, corresponding to erl_interface from 3.7.16 before 5.5.2.1, 5.7.0.1, and 5.8.1. Whether OTP before OTP&nbsp;17.0, corresponding to erl_interface before 3.7.16, is affected is unknown.</p>", "base64": false}, {"type": "text/markdown", "value": "Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow.\n\nThis vulnerability is associated with program file `lib/erl_interface/src/misc/ei_printterm.c` and program routine `ei_s_print_term`.\n\nThe C function `ei_s_print_term` uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of `0`-`9` and `A`-`F`, which limits exploitation to Denial of Service.\n\nThe companion function `ei_print_term`, which prints directly to a `FILE` instead of a memory buffer, does not contain this bug.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.13, OTP\u00a028.5.0.2, and OTP\u00a029.0.2, corresponding to erl_interface from 3.7.16 before 5.5.2.1, 5.7.0.1, and 5.8.1. Whether OTP before OTP\u00a017.0, corresponding to erl_interface before 3.7.16, is affected is unknown.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "27.3.4.13"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "28.5.0.2", "versionStartIncluding": "28.0"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "29.0.2", "versionStartIncluding": "29.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-09-24T20:42:47.418Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49760", "state": "PUBLISHED", "dateUpdated": "2026-09-24T20:42:47.418Z", "dateReserved": "2026-06-01T13:45:22.449Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-06-10T14:35:36.804Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["erl_interface"], "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "programFiles": ["lib/erl_interface/src/misc/ei_printterm.c"], "programRoutines": [{"name": "ei_s_print_term"}], "vendor": "Erlang", "versions": [{"changes": [{"at": "27.3.4.13", "status": "unaffected"}, {"at": "28.5.0.2", "status": "unaffected"}, {"at": "29.0.2", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["erl_interface"], "packageName": "erl_interface", "packageURL": "pkg:otp/erl_interface?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": ["src/misc/ei_printterm.c"], "programRoutines": [{"name": "ei_s_print_term"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "5.5.2.1", "status": "unaffected"}, {"at": "5.7.0.1", "status": "unaffected"}, {"at": "5.8.1", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "3.7.16", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["erl_interface"], "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "programFiles": ["lib/erl_interface/src/misc/ei_printterm.c"], "programRoutines": [{"name": "ei_s_print_term"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"lessThan": "0bef277b2d39dc8babb9ceb4f5d0a456f3007111", "status": "affected", "version": "84adefa331c4159d432d22840663c38f155cd4c1", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "0bef277b2d39dc8babb9ceb4f5d0a456f3007111", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erl_interface:*:*:*:*:*:*:*:*", "matchCriteriaId": "BC41283B-463D-427D-AF2F-AAA70D1F29FD", "versionEndExcluding": "5.5.2.1", "versionStartIncluding": "3.7.16", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erl_interface:*:*:*:*:*:*:*:*", "matchCriteriaId": "675D56C9-DBC3-4D8B-9599-5DC5677BA93B", "versionEndExcluding": "5.7.0.1", "versionStartIncluding": "5.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erl_interface:*:*:*:*:*:*:*:*", "matchCriteriaId": "2C3C2FDD-D25E-4290-8AA3-40EA8793CE59", "versionEndExcluding": "5.8.1", "versionStartIncluding": "5.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF42A5F2-4C27-43FE-B5FA-17A3422B9649", "versionEndExcluding": "27.3.4.13", "versionStartIncluding": "17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "902ED4C3-B9DE-4ABC-9BEA-D23DA4F5D373", "versionEndExcluding": "28.5.0.2", "versionStartIncluding": "28.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "F4AB1573-4E81-4338-B65A-B3C94C7249FA", "versionEndExcluding": "29.0.2", "versionStartIncluding": "29.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow.\n\nThis vulnerability is associated with program file lib/erl_interface/src/misc/ei_printterm.c and program routine ei_s_print_term.\n\nThe C function ei_s_print_term uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of 0-9 and A-F, which limits exploitation to Denial of Service.\n\nThe companion function ei_print_term, which prints directly to a FILE instead of a memory buffer, does not contain this bug.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.13, OTP\u00a028.5.0.2, and OTP\u00a029.0.2, corresponding to erl_interface from 3.7.16 before 5.5.2.1, 5.7.0.1, and 5.8.1. Whether OTP before OTP\u00a017.0, corresponding to erl_interface before 3.7.16, is affected is unknown."}, {"lang": "es", "value": "Vulnerabilidad de desbordamiento de b\u00fafer basado en pila en Erlang OTP (erl_interface) permite desbordamiento de b\u00fafer basado en pila.\n\nEsta vulnerabilidad est\u00e1 asociada con el archivo de programa lib/erl_interface/src/misc/ei_printterm.c y la rutina de programa ei_s_print_term.\n\nLa funci\u00f3n C ei_s_print_term utiliza un b\u00fafer de pila interno de 2000 caracteres para formatear t\u00e9rminos. Cuando se llama con un t\u00e9rmino Erlang codificado que contiene un entero muy grande (representaci\u00f3n codificada que excede los 2000 caracteres), el b\u00fafer se desborda. Los bytes desbordados est\u00e1n restringidos a los valores ASCII de 0-9 y A-F, lo que limita la explotaci\u00f3n a denegaci\u00f3n de servicio.\n\nLa funci\u00f3n compa\u00f1era ei_print_term, que imprime directamente a un FILE en lugar de un b\u00fafer de memoria, no contiene este error.\n\nEste problema afecta a OTP desde OTP 17.0 antes de 27.3.4.13, 28.5.0.2 y 29.0.2, correspondiente a erl_interface desde 3.7.16 antes de 5.5.2.1, 5.7.0.1 y 5.8.1."}], "id": "CVE-2026-49760", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49760", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-10T16:16:14.697009Z", "version": "2.0.3"}}]}, "published": "2026-06-10T16:17:12.947", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://cna.erlef.org/cves/CVE-2026-49760.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/erlang/otp/commit/0bef277b2d39dc8babb9ceb4f5d0a456f3007111"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-xcxj-5pg2-v72j"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-49760"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Product"], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.7.16,*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.5.2.1,5.5.2.1]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.7.0.1,5.7.0.1]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.8.1,5.8.1]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "erlang/otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[17.0,*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[27.3.4.13,27.3.4.13]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[28.5.0.2,28.5.0.2]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[29.0.2,29.0.2]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[84adefa331c4159d432d22840663c38f155cd4c1,0bef277b2d39dc8babb9ceb4f5d0a456f3007111)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "erlang/otp", "vendor": "erlang"}], "created": "2026-06-10T17:30:36.302679+00:00", "updated": "2026-09-26T06:30:03.500343+00:00", "vendors": ["erlang", "erlang$PRODUCT$erlang/otp"]}