CVE-2026-75538

Name of the Vulnerable Software and Affected Versions OTP versions 17.0 through 27.3.4.16 OTP versions 28.0 through 28.5.0.5 OTP versions 29.0 through 29.0.5 erts versions 6.0 through 15.2.7.12 erts versions 16.0 through 16.4.0.5 erts versions 17.0 through 17.0.5

Description An attacker connecting to an open Erlang TCP port using the inet driver with {packet,4} mode can trigger a signed overflow due to an incorrect packet length calculation. This allows the receive buffer to overflow into the VM allocator area and beyond by up to 2 GB, which typically corrupts the allocator metadata footer and subsequent blocks, leading to a BEAM VM crash. Achieving Remote Code Execution through this method is considered extremely unfeasible.

Recommendations Update OTP to version 27.3.4.17 or later. Update OTP to version 28.5.0.6 or later. Update OTP to version 29.0.6 or later. Update erts to version 15.2.7.13 or later. Update erts to version 16.4.0.6 or later. Update erts to version 17.0.6 or later.