Skip to content
Heist/ feed
Medium

Stack Buffer Overflow in ei_s_print_term at Very Large Integer

Type: advisorySource: Official CVE List1 source record

Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow. This vulnerability is associated with program file lib/erl_interface/src/misc/ei_printterm.c and program routine ei_s_print_term. The C function ei_s_print_term uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of 0-9 and A-F, which limits exploitation to Denial of Service. The companion function ei_print_term, which prints directly to a FILE instead of a memory buffer, does not contain this bug. This issue affects OTP from OTP 17.0 before OTP 27.3.4.13, OTP 28.5.0.2, and OTP 29.0.2, corresponding to erl_interface from 3.7.16 before 5.5.2.1, 5.7.0.1, and 5.8.1. Whether OTP before OTP 17.0, corresponding to erl_interface before 3.7.16, is affected is unknown.

Announced Source revision 1
Original source ↗

CVE-2026-49760

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-49760

OTP

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

OTP

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

OTP

Source reference: /containers/cna/affected/2/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "cpes": [
      "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
    ],
    "vendor": "Erlang",
    "modules": [
      "erl_interface"
    ],
    "product": "OTP",
    "versions": [
      {
        "status": "affected",
        "changes": [
          {
            "at": "27.3.4.13",
            "status": "unaffected"
          },
          {
            "at": "28.5.0.2",
            "status": "unaffected"
          },
          {
            "at": "29.0.2",
            "status": "unaffected"
          }
        ],
        "version": "17.0",
        "lessThan": "*",
        "versionType": "otp"
      }
    ],
    "packageURL": "pkg:software-id/erlang.org/otp",
    "packageName": "otp",
    "programFiles": [
      "lib/erl_interface/src/misc/ei_printterm.c"
    ],
    "defaultStatus": "unknown",
    "programRoutines": [
      {
        "name": "ei_s_print_term"
      }
    ]
  },
  {
    "cpes": [
      "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
    ],
    "repo": "https://github.com/erlang/otp",
    "vendor": "Erlang",
    "modules": [
      "erl_interface"
    ],
    "product": "OTP",
    "versions": [
      {
        "status": "affected",
        "changes": [
          {
            "at": "5.5.2.1",
            "status": "unaffected"
          },
          {
            "at": "5.7.0.1",
            "status": "unaffected"
          },
          {
            "at": "5.8.1",
            "status": "unaffected"
          }
        ],
        "version": "3.7.16",
        "lessThan": "*",
        "versionType": "otp"
      }
    ],
    "packageURL": "pkg:otp/erl_interface?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
    "packageName": "erl_interface",
    "programFiles": [
      "src/misc/ei_printterm.c"
    ],
    "defaultStatus": "unknown",
    "programRoutines": [
      {
        "name": "ei_s_print_term"
      }
    ]
  },
  {
    "cpes": [
      "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
    ],
    "repo": "https://github.com/erlang/otp",
    "vendor": "Erlang",
    "modules": [
      "erl_interface"
    ],
    "product": "OTP",
    "versions": [
      {
        "status": "affected",
        "version": "84adefa331c4159d432d22840663c38f155cd4c1",
        "lessThan": "0bef277b2d39dc8babb9ceb4f5d0a456f3007111",
        "versionType": "git"
      },
      {
        "status": "unaffected",
        "version": "0bef277b2d39dc8babb9ceb4f5d0a456f3007111",
        "lessThan": "*",
        "versionType": "git"
      }
    ],
    "packageURL": "pkg:github/erlang/otp",
    "packageName": "erlang/otp",
    "programFiles": [
      "lib/erl_interface/src/misc/ei_printterm.c"
    ],
    "collectionURL": "https://github.com",
    "defaultStatus": "unknown",
    "programRoutines": [
      {
        "name": "ei_s_print_term"
      }
    ]
  }
]
Related CVEs
CVE-2026-49760

Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event
#1892 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement