A buffer overflow exists in the megaco flex scanner C driver. A remote unauthenticated attacker can corrupt the driver's memory by sending a text-encoded H.248/Megaco message containing an oversized property parm name. During the tokenization of a Local/Remote descriptor, the `mfs load property groups()` function extracts the property name and formats it into a fixed 512-byte `error msg` field of the `MfsErlDrvData` struct using an unchecked `sprintf` call. Names exceeding approximately 452 bytes overflow into adjacent struct fields, including `text buf`, `text ptr`, `term spec`, `term spec size`, and `term spec index`. This allows the attacker to overwrite pointers and counters, potentially leading to arbitrary write and free primitives within the BEAM VM process, which can result in remote code execution. On builds compiled with ` FORTIFY SOURCE`, the overflow triggers a SIGABRT, causing a denial of service. The issue occurs before authentication processing and requires the node to be configured with `{scanner, flex}`.