CVE-2026-75538

A signed integer overflow in the packet-length calculation of Erlang/OTP's inet TCP driver, when a TCP listener runs in {packet,4} framing mode, lets a remote, unauthenticated attacker trigger a receive-buffer overflow of up to about 2 GB. The overflow trashes the allocated block's allocator metadata footer, any adjacent heap block, and beyond, which most likely crashes the BEAM VM and causes denial of service; achieving remote code execution with the required precision is described as extremely unfeasible. Any Erlang/OTP installation running an affected release that exposes a TCP listener in {packet,4} mode on a network reachable by attackers is affected, such as Erlang's node-to-node distribution ports or custom gen_tcp services built on that framing. Releases older than OTP 17.0 may also be affected, but this is unknown. No public proof-of-concept or in-the-wild exploitation is known, and EPSS estimates only about a 0.5% probability of exploitation within 30 days.

What to do: Upgrade Erlang/OTP to OTP 27.3.4.17, OTP 28.5.0.6, or OTP 29.0.6 as applicable (corresponding to erts 15.2.7.13, 16.4.0.6, or 17.0.6), and treat pre-OTP-17 releases as potentially affected until clarified. Until patched, restrict network access to Erlang TCP listeners — especially EPMD (TCP 4369) and node-distribution ports — and audit applications for gen_tcp listeners configured with {packet,4} that are reachable from untrusted networks. The expected impact is a VM crash (denial of service), so prioritize patches for exposed, unauthenticated listeners.