{"id":"CVE-2026-49760","revision":"a55cd15bab394a9bbd38820be2c3518e","records":[{"revision":"a55cd15bab394a9bbd38820be2c3518e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-49760","aliases":[],"title":"Stack Buffer Overflow in ei_s_print_term at Very Large Integer","description":"Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow.\n\nThis vulnerability is associated with program file lib/erl_interface/src/misc/ei_printterm.c and program routine ei_s_print_term.\n\nThe C function ei_s_print_term uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of 0-9 and A-F, which limits exploitation to Denial of Service.\n\nThe companion function ei_print_term, which prints directly to a FILE instead of a memory buffer, does not contain this bug.\n\nThis issue affects OTP from OTP\u00A017.0 before OTP\u00A027.3.4.13, OTP\u00A028.5.0.2, and OTP\u00A029.0.2, corresponding to erl_interface from 3.7.16 before 5.5.2.1, 5.7.0.1, and 5.8.1. Whether OTP before OTP\u00A017.0, corresponding to erl_interface before 3.7.16, is affected is unknown.","state":0,"publishedAt":"2026-06-10T14:35:36.804+00:00","modifiedAt":"2026-09-24T20:42:47.418+00:00","affected":[{"ecosystem":"Vendor product","name":"otp","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"cpes\": [\n                        \"cpe:2.3:a:erlang:erlang\\\\/otp:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"defaultStatus\": \"unknown\",\n                    \"modules\": [\n                        \"erl_interface\"\n                    ],\n                    \"packageName\": \"otp\",\n                    \"packageURL\": \"pkg:software-id/erlang.org/otp\",\n                    \"product\": \"OTP\",\n                    \"programFiles\": [\n                        \"lib/erl_interface/src/misc/ei_printterm.c\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"ei_s_print_term\"\n                        }\n                    ],\n                    \"vendor\": \"Erlang\",\n                    \"versions\": [\n                        {\n                            \"changes\": [\n                                {\n                                    \"at\": \"27.3.4.13\",\n                                    \"status\": \"unaffected\"\n                                },\n                                {\n                                    \"at\": \"28.5.0.2\",\n                                    \"status\": \"unaffected\"\n                                },\n                                {\n                                    \"at\": \"29.0.2\",\n                                    \"status\": \"unaffected\"\n                                }\n                            ],\n                            \"lessThan\": \"*\",\n                            \"status\": \"affected\",\n                            \"version\": \"17.0\",\n                            \"versionType\": \"otp\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"erl_interface","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"cpes\": [\n                        \"cpe:2.3:a:erlang:erlang\\\\/otp:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"defaultStatus\": \"unknown\",\n                    \"modules\": [\n                        \"erl_interface\"\n                    ],\n                    \"packageName\": \"erl_interface\",\n                    \"packageURL\": \"pkg:otp/erl_interface?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git\",\n                    \"product\": \"OTP\",\n                    \"programFiles\": [\n                        \"src/misc/ei_printterm.c\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"ei_s_print_term\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/erlang/otp\",\n                    \"vendor\": \"Erlang\",\n                    \"versions\": [\n                        {\n                            \"changes\": [\n                                {\n                                    \"at\": \"5.5.2.1\",\n                                    \"status\": \"unaffected\"\n                                },\n                                {\n                                    \"at\": \"5.7.0.1\",\n                                    \"status\": \"unaffected\"\n                                },\n                                {\n                                    \"at\": \"5.8.1\",\n                                    \"status\": \"unaffected\"\n                                }\n                            ],\n                            \"lessThan\": \"*\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.7.16\",\n                            \"versionType\": \"otp\"\n                        }\n                    ]\n                }"},{"ecosystem":"https://github.com","name":"erlang/otp","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://github.com\",\n                    \"cpes\": [\n                        \"cpe:2.3:a:erlang:erlang\\\\/otp:*:*:*:*:*:*:*:*\"\n                    ],\n                    \"defaultStatus\": \"unknown\",\n                    \"modules\": [\n                        \"erl_interface\"\n                    ],\n                    \"packageName\": \"erlang/otp\",\n                    \"packageURL\": \"pkg:github/erlang/otp\",\n                    \"product\": \"OTP\",\n                    \"programFiles\": [\n                        \"lib/erl_interface/src/misc/ei_printterm.c\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"ei_s_print_term\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/erlang/otp\",\n                    \"vendor\": \"Erlang\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"0bef277b2d39dc8babb9ceb4f5d0a456f3007111\",\n                            \"status\": \"affected\",\n                            \"version\": \"84adefa331c4159d432d22840663c38f155cd4c1\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"lessThan\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"version\": \"0bef277b2d39dc8babb9ceb4f5d0a456f3007111\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":6.9,"severity":"MEDIUM"}],"references":["https://github.com/erlang/otp/security/advisories/GHSA-xcxj-5pg2-v72j","https://cna.erlef.org/cves/CVE-2026-49760.html","https://osv.dev/vulnerability/EEF-CVE-2026-49760","https://www.erlang.org/doc/system/versions.html#order-of-versions","https://github.com/erlang/otp/commit/0bef277b2d39dc8babb9ceb4f5d0a456f3007111"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-49760","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-49760","identifiers":["CVE-2026-49760"]},"retained":false,"historicalAffected":[]}],"coverage":[]}