SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-55737

HIGH · CVSS 7.5 EPSS 0.29% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-27 · Last synced 2026-08-26

CyberRota Analysis

AI-Generated

The vulnerability in Erlang OTP's erts module allows an attacker to exploit a signed to unsigned conversion error when processing crafted Erlang external term format (ETF) binaries, leading to an out-of-bounds write that can crash the virtual machine. This issue affects versions from OTP 25.0 to before OTP 29.0.4, as well as specific patched versions of OTP 28 and OTP 27. Organizations using these affected versions should prioritize remediation to prevent potential denial-of-service attacks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-55737
Severity
HIGH
CVSS
7.5
EPSS
0.29%

Original NVD Description

Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format (ETF) binary to binary_to_term/1 to corrupt the BEAM heap pointer and crash the virtual machine. When decoding a LARGE_TUPLE_EXT term, the validation pass decoded_size() in erts/emulator/beam/external.c reads the 32-bit arity field as unsigned (get_uint32()), while the decode pass dec_term() reads the same field as a signed 32-bit integer (get_int32()) into an int. An arity wire value of 0x80000000 passes validation as 2147483648 but decodes as -2147483648, so the subsequent hp += n moves the heap allocation pointer backward. Neither pass enforces the runtime tuple-arity limit MAX_ARITYVAL. The result is an out-of-bounds heap write; in practice the VM detects an impossible heap size and aborts, denying service. The required padding is large when uncompressed but the compressed-ETF envelope shrinks it to a small payload on the wire. This issue affects OTP from OTP 25.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 13.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.

Related CVEs

Other vulnerabilities affecting the same vendor(s)