CVE-2026-59250: Erlang/OTP Megaco Buffer Overflow Flaw

CVE-2026-59250 Overview

CVE-2026-59250 is a classic buffer overflow [CWE-120] in the Erlang/OTP megaco flex scanner C driver. A remote unauthenticated attacker can corrupt driver memory by sending a single text-encoded H.248/Megaco message containing an oversized property parm name. The overflow occurs before any grammar or Megaco-level authentication processing, requiring only network reachability to the megaco transport port on a node configured with {scanner, flex}. Successful exploitation can lead to remote code execution inside the BEAM VM process, or a SIGABRT crash on builds compiled with _FORTIFY_SOURCE.

Critical Impact
Unauthenticated remote attackers can achieve arbitrary write and arbitrary free primitives inside the BEAM VM, enabling remote code execution or denial of service against telecom infrastructure using Erlang/OTP megaco.

Affected Products

Erlang/OTP from OTP 17.0 before OTP 29.0.4
Erlang/OTP 28.5.0.4 and earlier in the 28.x branch
Erlang/OTP 27.3.4.15 and earlier in the 27.x branch (megaco 3.17.1 before 4.9.1, 4.8.3.1, 4.7.2.2)

Discovery Timeline

2026-07-27 - CVE-2026-59250 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-59250

Vulnerability Analysis

The vulnerability resides in mfs_load_property_groups within lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src. When tokenizing a Local or Remote descriptor, the function extracts an attacker-controlled property name whose length is bounded only by the overall message length. When no value follows the name, the code formats the name into a fixed 512-byte error_msg field of the MfsErlDrvData struct using an unchecked sprintf call.

Property names longer than roughly 452 bytes overflow past error_msg into adjacent struct fields including text_buf, text_ptr, term_spec, term_spec_size, and term_spec_index. Attacker-chosen bytes overwrite live pointers and length counters used by later scanner logic.

Root Cause

The root cause is use of sprintf without bounds checking against a fixed-size destination buffer. The length precheck accounts only for a static message and size suffix, not the attacker-controlled msg argument itself. This is a textbook CWE-120 classic buffer overflow.

Attack Vector

An attacker sends a single text-encoded H.248/Megaco message containing an oversized property parm name to the megaco transport port. Subsequent scanner code then writes and frees through the corrupted pointers, yielding arbitrary write and arbitrary free primitives inside the BEAM VM process. These primitives can be chained for remote code execution. On hardened builds with _FORTIFY_SOURCE, the runtime detects the overflow and terminates the process with SIGABRT, causing denial of service.

text

     int msg_len = strlen(msg);
     if ((10 + 10 + msg_len) < sizeof(dataP->error_msg)) {
-      if (0 >= sprintf(dataP->error_msg, "%s of %d bytes", msg, sz)) {
+      if (0 >= snprintf(dataP->error_msg, sizeof(dataP->error_msg), "%s of %d bytes", msg, sz)) {
 	mfs_fatal_error(dataP, msg);
       }
     } else {

Source: GitHub commit 8704c8f. The patch replaces the unchecked sprintf call with snprintf using an explicit destination size, preventing writes past error_msg.

Detection Methods for CVE-2026-59250

Indicators of Compromise

Unexpected SIGABRT termination of BEAM VM processes hosting the megaco application on _FORTIFY_SOURCE-hardened builds.
Inbound H.248/Megaco text-encoded messages containing property parm names larger than 452 bytes.
Repeated crashes or restarts of Erlang nodes running with the {scanner, flex} configuration.

Detection Strategies

Inspect network traffic to megaco transport ports for text-encoded Megaco messages with abnormally long property name tokens inside Local or Remote descriptors.
Correlate BEAM process crash events with recent inbound Megaco traffic to identify targeted probing.
Audit Erlang release manifests for megaco versions predating 4.9.1, 4.8.3.1, or 4.7.2.2.

Monitoring Recommendations

Enable core dump collection on BEAM processes to detect fortify-triggered aborts referencing mfs_load_property_groups.
Log all connections to megaco listener ports and flag sources sending oversized payloads.
Track EPSS scoring (currently 0.73%) and CISA advisories for changes in exploitation likelihood.

How to Mitigate CVE-2026-59250

Immediate Actions Required

Upgrade Erlang/OTP to 29.0.4, 28.5.0.5 (or later 28.x containing the fix), or 27.3.4.16, corresponding to megaco 4.9.1, 4.8.3.1, or 4.7.2.2.
Restrict network access to megaco transport ports to trusted peers using firewall rules or network segmentation.
Audit all Erlang deployments for nodes configured with {scanner, flex} and prioritize their remediation.

Patch Information

The fix is committed in erlang/otp commit 8704c8f and documented in GHSA-7xgh-gmgf-q2g7. Additional context is available in the CNA CVE-2026-59250 entry and the OSV vulnerability entry.

Workarounds

Switch the megaco scanner configuration away from the flex driver to the pure Erlang scanner by setting {scanner, erl_scanner} until patching is possible.
Terminate inbound Megaco text encoding at a proxy or session border controller that enforces maximum token lengths.
Compile Erlang/OTP with _FORTIFY_SOURCE to convert exploitation attempts into process aborts rather than code execution, accepting denial of service as the residual risk.

bash

# Verify installed OTP and megaco versions
erl -eval 'io:format("OTP: ~s~nMegaco: ~s~n", [erlang:system_info(otp_release), element(2, application:get_key(megaco, vsn))]), halt().' -noshell

# Switch to the non-vulnerable pure Erlang scanner in sys.config
# [{megaco, [{scanner, erl_scanner}]}].