Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-55737— Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder

Quick assessment

Affected
Erlang OTP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

erlang erlang/otp是erlang社区开源的一套并发编程语言及运行时系统。 erlang/otp 25.0版本至29.0.4之前版本存在安全漏洞，该漏洞源于有符号数与无符号数转换错误和越界写入，可能导致攻击者通过特制的Erlang外部项格式（ETF）二进制数据破坏BEAM堆指针并造成虚拟机崩溃。

CVSS 5.1 · Medium EPSS 0.29% · P22

Affected Version Matrix 3

VendorProduct Version RangeStatus
Erlang OTP 13.0< * affected
25.0< * affected
ebcbb97b4ec223464cac3d94375739a248ddef6e< c5210b42a9d3d96f3d25601942ce8122be0f3761 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55737

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder
Source: CVE Program / CVE List V5
Vulnerability Description
Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format (ETF) binary to binary_to_term/1 to corrupt the BEAM heap pointer and crash the virtual machine. When decoding a LARGE_TUPLE_EXT term, the validation pass decoded_size() in erts/emulator/beam/external.c reads the 32-bit arity field as unsigned (get_uint32()), while the decode pass dec_term() reads the same field as a signed 32-bit integer (get_int32()) into an int. An arity wire value of 0x80000000 passes validation as 2147483648 but decodes as -2147483648, so the subsequent hp += n moves the heap allocation pointer backward. Neither pass enforces the runtime tuple-arity limit MAX_ARITYVAL. The result is an out-of-bounds heap write; in practice the VM detects an impossible heap size and aborts, denying service. The required padding is large when uncompressed but the compressed-ETF envelope shrinks it to a small payload on the wire. This issue affects OTP from OTP 25.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 13.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
有符号至无符号转换错误
Source: CVE Program / CVE List V5
Vulnerability Title
erlang/otp 数字错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
erlang erlang/otp是erlang社区开源的一套并发编程语言及运行时系统。 erlang/otp 25.0版本至29.0.4之前版本存在安全漏洞，该漏洞源于有符号数与无符号数转换错误和越界写入，可能导致攻击者通过特制的Erlang外部项格式（ETF）二进制数据破坏BEAM堆指针并造成虚拟机崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Erlang OTP 13.0 ~ * cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Erlang OTP 25.0 ~ * cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-55737

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55737

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55737 (1)

Vendor Advisories for CVE-2026-55737 (3)

Same Patch Batch · Erlang · 2026-07-27 · 8 CVEs total

CVE-2026-55953 9.1 CRITICAL TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authent
CVE-2026-58227 8.7 HIGH TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain
CVE-2026-59251 8.7 HIGH Denial of service via exponential certificate policy tree growth in path validation
CVE-2026-59250 8.3 HIGH Megaco flex scanner buffer overflow via oversized property parm name
CVE-2026-54890 8.2 HIGH BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding
CVE-2026-42792 6.3 MEDIUM epmd permanent DoS via EMFILE on accept(2) in erts
CVE-2026-47078 4.8 MEDIUM Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass

IV. Related Vulnerabilities

Same product: OTP
Same vendor: Erlang
Same weakness: CWE-195

V. Comments for CVE-2026-55737

No comments yet

Leave a comment