Paul Guyot

**Name of the Vulnerable Software and Affected Versions** erlang otp versions 27.0 through 27.3.4.14 erlang otp version 28.5.0.3 erlang otp versions 29.0 through 29.0.3 erts versions 15.0 through 15.2.7.10 erts version 16.4.0.3 erts versions 17.0 through 17.0.3 **Description** An integer underflow exists in the External Term Format (ETF) decoder within the `BIT BINARY EXT` tag (77) handler. When the decoder accepts an encoding where both length and trailing-bits fields are set to zero, the bitstring size computation underflows an unsigned integer. This results in an extremely large value (approximately 2^64) being passed as a memory allocation size, causing the allocator to abort the entire node. This VM-level abort cannot be intercepted by supervision trees, try/catch blocks, or the `[safe]` option in `binary to term/2`. Applications decoding ETF from untrusted sources using `binary to term/1,2` or `enif binary to term()` are exposed. The Erlang distribution protocol also uses this code path, though it is intended for trusted networks. **Recommendations** Update erlang otp to version 27.3.4.15, 28.5.0.4, or 29.0.4. Update erts to version 15.2.7.11, 16.4.0.4, or 17.0.4. Avoid calling `binary to term/1,2` or `enif binary to term()` on data from untrusted sources. Use alternative serialization formats such as JSON or Protocol Buffers instead of ETF for untrusted input.