Stack Buffer Overflow in ei_s_print_term at Very Large Integer
Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow. This vulnerability is associated with program file lib/erl_interface/src/misc/ei_printterm.c and program routine ei_s_print_term. The C function ei_s_print_term uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of 0-9 and A-F, which limits exploitation to Denial of Service. The companion function ei_print_term, which prints directly to a FILE instead of a memory buffer, does not contain this bug. This issue affects OTP from OTP 17.0 before OTP 27.3.4.13, OTP 28.5.0.2, and OTP 29.0.2, corresponding to erl_interface from 3.7.16 before 5.5.2.1, 5.7.0.1, and 5.8.1. Whether OTP before OTP 17.0, corresponding to erl_interface before 3.7.16, is affected is unknown.
CVE-2026-49760
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-49760
OTP
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
OTP
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
OTP
Source reference: /containers/cna/affected/2/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"vendor": "Erlang",
"modules": [
"erl_interface"
],
"product": "OTP",
"versions": [
{
"status": "affected",
"changes": [
{
"at": "27.3.4.13",
"status": "unaffected"
},
{
"at": "28.5.0.2",
"status": "unaffected"
},
{
"at": "29.0.2",
"status": "unaffected"
}
],
"version": "17.0",
"lessThan": "*",
"versionType": "otp"
}
],
"packageURL": "pkg:software-id/erlang.org/otp",
"packageName": "otp",
"programFiles": [
"lib/erl_interface/src/misc/ei_printterm.c"
],
"defaultStatus": "unknown",
"programRoutines": [
{
"name": "ei_s_print_term"
}
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"modules": [
"erl_interface"
],
"product": "OTP",
"versions": [
{
"status": "affected",
"changes": [
{
"at": "5.5.2.1",
"status": "unaffected"
},
{
"at": "5.7.0.1",
"status": "unaffected"
},
{
"at": "5.8.1",
"status": "unaffected"
}
],
"version": "3.7.16",
"lessThan": "*",
"versionType": "otp"
}
],
"packageURL": "pkg:otp/erl_interface?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"packageName": "erl_interface",
"programFiles": [
"src/misc/ei_printterm.c"
],
"defaultStatus": "unknown",
"programRoutines": [
{
"name": "ei_s_print_term"
}
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"modules": [
"erl_interface"
],
"product": "OTP",
"versions": [
{
"status": "affected",
"version": "84adefa331c4159d432d22840663c38f155cd4c1",
"lessThan": "0bef277b2d39dc8babb9ceb4f5d0a456f3007111",
"versionType": "git"
},
{
"status": "unaffected",
"version": "0bef277b2d39dc8babb9ceb4f5d0a456f3007111",
"lessThan": "*",
"versionType": "git"
}
],
"packageURL": "pkg:github/erlang/otp",
"packageName": "erlang/otp",
"programFiles": [
"lib/erl_interface/src/misc/ei_printterm.c"
],
"collectionURL": "https://github.com",
"defaultStatus": "unknown",
"programRoutines": [
{
"name": "ei_s_print_term"
}
]
}
]- Related CVEs
- CVE-2026-49760
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #1892 · Revision 1
- Added to Heist Feed
- Publisher date