vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-49760

Stack Buffer Overflow in ei_s_print_term at Very Large Integer

MEDIUM
5.5
CVSS Score
Published: June 10, 2026 at 02:35 PM UTC
Updated: October 26, 2026 at 11:10 AM UTC
2 products affected across 1 vendorErlang /otpErl Interface

Using OTP by Erlang?

Get instant alerts when new vulnerabilities affect OTP - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.1%
SSVC
No known exploit

Description

Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow. This vulnerability is associated with program file lib/erl_interface/src/misc/ei_printterm.c and program routine ei_s_print_term. The C function ei_s_print_term uses an internal 2000-character stack buffer to format terms. When called with an encoded Erlang term containing a very large integer (encoded representation exceeding 2000 characters), the buffer overflows. The overflow bytes are restricted to the ASCII values of 0-9 and A-F, which limits exploitation to Denial of Service. The companion function ei_print_term, which prints directly to a FILE instead of a memory buffer, does not contain this bug. This issue affects OTP from OTP 17.0 before 27.3.4.13, 28.5.0.2 and 29.0.2, corresponding to erl_interface from 3.7.16 before 5.5.2.1, 5.7.0.1 and 5.8.1.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Erl Interface· Erlang
95%
3.7.16 ≤ v < 5.5.2.15.7 ≤ v < 5.7.0.15.8 ≤ v < 5.8.1
Affected range stops below 5.5.2.1, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.7.0.1, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.8.1, so it looks safe — our inference, not a vendor statement
Erlang /otp· Erlang
95%
17.0 ≤ v < 27.3.4.1328.0 ≤ v < 28.5.0.229.0 ≤ v < 29.0.217.03.7.1684adefa331c4159d432d22840663c38f155cd4c1
Vendor states this is fixed in 0bef277b2d39dc8babb9ceb4f5d0a456f3007111 (unaffected)
Affected range stops below 27.3.4.13, so it looks safe — our inference, not a vendor statement
Affected range stops below 28.5.0.2, so it looks safe — our inference, not a vendor statement
Affected range stops below 29.0.2, so it looks safe — our inference, not a vendor statement

References (5)

Vendor AdvisoryRelatedMitigation
Source: cverecord
https://github.com/erlang/otp/security/advisories/GHSA-xcxj-5pg2-v72j
RelatedMitigationThird Party Advisory
Source: cverecord
https://cna.erlef.org/cves/CVE-2026-49760.html
RelatedMitigationThird Party Advisory
Source: cverecord
https://osv.dev/vulnerability/EEF-CVE-2026-49760
x_version-schemeProduct
Source: cverecord
https://www.erlang.org/doc/system/versions.html#order-of-versions
Patch
Source: cverecord
https://github.com/erlang/otp/commit/0bef277b2d39dc8babb9ceb4f5d0a456f3007111

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.5MEDIUM[email protected]
Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-121

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card