CVE-2026-75538 Overview
CVE-2026-75538 is a heap-based buffer overflow [CWE-122] in the Erlang/OTP inet driver caused by a signed integer overflow in the packet length calculation. An unauthenticated attacker that connects to an open Erlang TCP port using {packet,4} framing mode can trigger the flaw by sending a crafted packet header. The incorrect length arithmetic allows writes past the receive buffer into the BEAM virtual machine allocator area, corrupting up to roughly 2 GB of adjacent memory.
Critical Impact
Remote unauthenticated attackers can corrupt BEAM VM allocator metadata and crash the Erlang runtime, producing a denial-of-service condition on any service exposing an inet driver TCP port with {packet,4} framing.
Affected Products
- Erlang/OTP 17.0 through versions before 27.3.4.17 (erts 6.0 before 15.2.7.13)
- Erlang/OTP 28.0 through versions before 28.5.0.6 (erts 16.0 before 16.4.0.6)
- Erlang/OTP 29.0 through versions before 29.0.6 (erts 17.0 before 17.0.6)
Discovery Timeline
- 2026-09-01 - CVE-2026-75538 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-75538
Vulnerability Analysis
The vulnerability resides in the packet parser used by the Erlang inet driver when a socket is configured with {packet,4} framing. In this mode, each inbound packet is prefixed with a 4-byte length header that the driver reads to size the receive buffer. The parser calculates the total length as hlen + plen using signed int arithmetic without validating the intermediate result against INT_MAX.
An attacker who supplies a large plen value causes the addition to overflow into a negative or truncated value. The subsequent buffer sizing check treats the result as valid, allowing the driver to write attacker-controlled bytes beyond the allocated receive buffer boundary. The write can extend into BEAM VM allocator metadata and adjacent heap blocks.
Exploitation reliably corrupts allocator footer metadata and neighboring blocks, which crashes the BEAM VM. The Erlef advisory notes that achieving reliable Remote Code Execution through this primitive is not feasible in practice, so the practical impact is limited to a denial-of-service outcome.
Root Cause
The defect is a classic signed integer overflow leading to a heap buffer overflow. Both packet_parser.c and inet_drv.c performed used + len and hlen + plen additions on signed int operands without pre-checking whether the sum would exceed INT_MAX. Because the overflow yields a value smaller than expected, the fit-check logic underestimates the required buffer and permits an oversized write.
Attack Vector
The attack requires network reachability to any TCP port served by an Erlang application that opens sockets with the {packet,4} option. No authentication, credentials, or user interaction are needed. Common exposures include custom Erlang and Elixir services, distribution ports, and any application built on gen_tcp that selects the {packet,4} framing mode.
// Patch: erts/emulator/beam/packet_parser.c - Avoid signed int overflows
return 0;
remain:
- {
- int tlen = hlen + plen;
- if ((max_plen != 0 && plen > max_plen)
- || tlen < (int)hlen) { /* wrap-around protection */
- return -1;
- }
- return tlen;
- }
+ ASSERT(INT_MAX >= hlen);
+ if (max_plen == 0) {
+ max_plen = INT_MAX - hlen;
+ }
+ if (plen > max_plen) {
+ return -1;
+ }
+ return hlen + plen;
done:
return plen;
Source: GitHub OTP Commit 08e8efd
The fix in inet_drv.c applies the same defensive pattern to the buffer-sizing helper:
// Patch: erts/emulator/drivers/common/inet_drv.c - Avoid signed int overflows
int offs1;
int offs2;
int used = desc->i_ptr_start - desc->i_buf->orig_bytes;
- int ulen = used + len;
+ int ulen;
+
+ if (len > INT_MAX - used) {
+ return -1;
+ }
+ ulen = used + len;
if (desc->i_bufsz >= ulen) /* packet will fit */
return 0;
Source: GitHub OTP Commit 08e8efd
Detection Methods for CVE-2026-75538
Indicators of Compromise
- Unexpected BEAM VM crashes or erl_crash.dump files generated on hosts running Erlang/OTP services that accept external TCP connections.
- Allocator assertion failures or segmentation faults logged by beam.smp shortly after inbound TCP sessions on {packet,4} ports.
- Inbound TCP packets whose 4-byte length prefix approaches or exceeds 0x7FFFFFFF on ports served by Erlang applications.
Detection Strategies
- Inventory all Erlang/OTP deployments and identify listeners that use gen_tcp:listen/2 or gen_tcp:connect/3 with the {packet,4} option.
- Deploy network signatures on internal IDS/IPS that flag TCP payloads to Erlang service ports whose 4-byte header declares lengths above a defined operational maximum.
- Correlate host process termination events for beam.smp with concurrent inbound connections from a single source to identify probing.
Monitoring Recommendations
- Forward Erlang crash dumps and syslog output to a centralized logging pipeline and alert on repeated beam.smp restarts.
- Track connection rate and byte-length distributions per Erlang listener to baseline normal traffic and surface anomalies.
- Monitor egress and ingress on distribution ports (typically 4369 for epmd and dynamically assigned distribution ports) for connections from unexpected peers.
How to Mitigate CVE-2026-75538
Immediate Actions Required
- Upgrade to Erlang/OTP 27.3.4.17, 28.5.0.6, or 29.0.6 depending on the deployed major branch.
- Restrict network exposure of Erlang TCP listeners by binding to loopback or placing them behind authenticated reverse proxies where feasible.
- Enforce firewall rules that limit access to Erlang distribution and application ports to trusted management networks only.
Patch Information
The Erlang Ecosystem Foundation released fixed builds across all supported branches. The corrective commit 08e8efdba8500d2d6f54c6b1de1492b228017c9b adds INT_MAX bounds checks in both packet_parser.c and inet_drv.c. Refer to the Erlang Security Advisory GHSA-8m6r-2pj2-25pm and the CNA advisory for CVE-2026-75538 for authoritative release notes.
Workarounds
- Where patching is not immediately possible, avoid the {packet,4} framing mode and use application-layer length validation with {packet,raw} plus explicit bounds checks.
- Terminate TLS in front of Erlang listeners to require client certificates and eliminate unauthenticated access.
- Apply operating system firewall rules to drop inbound TCP payloads exceeding a known safe maximum for the affected service.
# Verify installed Erlang/OTP version and confirm patched build
erl -eval 'io:format("~s~n", [erlang:system_info(otp_release)]), halt().' -noshell
cat "$(dirname $(which erl))/../releases/$(erl -eval 'io:format("~s",[erlang:system_info(otp_release)]),halt().' -noshell)/OTP_VERSION"
# Example nftables rule limiting an Erlang service port to a management subnet
nft add rule inet filter input tcp dport 8443 ip saddr != 10.10.0.0/24 drop
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
