CVE-2026-75538: 
CBL Mariner Analyse et atténuation des vulnérabilités

CVE-2026-75538 is a signed integer overflow vulnerability in Erlang/OTP's inet TCP driver that allows an unauthenticated remote attacker to overflow the receive buffer into BEAM VM allocator memory, most likely causing a denial of service (VM crash). It affects Erlang/OTP from version 17.0 before 27.3.4.17, from 28.0 before 28.5.0.6, and from 29.0 before 29.0.6 (corresponding to erts versions 6.0–15.2.7.13, 16.0–16.4.0.6, and 17.0–17.0.6); versions prior to OTP 17.0 may also be affected but are unconfirmed. The vulnerability was published on September 1, 2026, and was discovered by Claude (Anthropic's AI assistant), triaged by Ada Logics in collaboration with Anthropic Research. It carries a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory, Microsoft MSRC).

The root cause is a signed integer overflow (CWE-190) in the packet_get_length() function within erts/emulator/beam/packet_parser.c, combined with a heap-based buffer overflow (CWE-122) in tcp_expand_buffer() in inet_drv.c. When a TCP port uses the inet driver with {packet,4} mode, the 4-byte packet length field is read and used in an arithmetic calculation (hlen + plen) without proper bounds checking, allowing a crafted packet with a large length value to cause a signed integer wraparound. This overflows the receive buffer into the BEAM VM allocator area by up to approximately 2 GB, corrupting allocator metadata footers and adjacent memory blocks. The attack requires network access to an open Erlang TCP port configured with {packet,4} mode and no {packet_size, MaxPacketSize} restriction; no authentication is required. The fix, committed as 08e8efd, adds explicit overflow guards before the addition operations in both affected files (GitHub Advisory, Fix Commit).

Successful exploitation causes the BEAM VM to crash, resulting in a complete denial of service for any application running on the affected Erlang/OTP node. The vulnerability has no confidentiality or integrity impact — data exfiltration and unauthorized modification are not achievable through this flaw. Remote code execution is theoretically conceivable due to the memory corruption, but is assessed as extremely unfeasible in practice given the imprecision of the overflow (GitHub Advisory). Systems using Erlang/OTP for high-availability services (e.g., RabbitMQ, Ejabberd, or other telecom/messaging infrastructure) face the greatest operational risk from availability disruption.

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The EPSS score is approximately 0.49%, reflecting low near-term exploitation probability. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The attack requires the target TCP port to be reachable and configured with {packet,4} mode, which is an attack requirement (AT:P in CVSS v4.0) that limits the exploitable surface. The NVD SSVC assessment also classifies exploitation as "none" and the vulnerability as not automatable (GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible services running Erlang/OTP (e.g., RabbitMQ AMQP ports, Ejabberd XMPP ports, or custom Erlang TCP services) using tools like Shodan, Censys, or nmap. Confirm the target is running a vulnerable OTP version (17.0–27.3.4.16, 28.0–28.5.0.5, or 29.0–29.0.5).
2. Identify {packet,4} mode ports: Determine which TCP ports use the inet driver with {packet,4} framing. This is common in Erlang distribution ports and some application protocols. Ports without {packet_size, N} restrictions are the primary targets.
3. Craft malicious packet: Construct a TCP packet where the 4-byte length header contains a value that, when added to the header length (hlen), causes a signed 32-bit integer overflow (e.g., a value near 2^31 - 1 or 0x7FFFFFFF).
4. Send crafted packet: Connect to the target TCP port and transmit the malformed packet. The vulnerable packet_get_length() function will compute an overflowed (negative or very large) total length, causing tcp_expand_buffer() to allocate or write beyond the intended buffer boundary.
5. Trigger VM crash: The overflow corrupts BEAM VM allocator metadata, causing the VM to crash and the Erlang node (and all hosted services) to become unavailable (GitHub Advisory, Fix Commit).

• Network: Unexpected TCP connections to Erlang service ports (e.g., AMQP 5672, XMPP 5222/5269, Erlang distribution 4369/epmd, or custom ports) from untrusted or unknown source IPs; single-packet connections that immediately terminate after sending a large or malformed length field.
• Logs: Erlang/OTP crash dump files (erl_crash.dump) generated unexpectedly in the working directory of the BEAM process; OS-level segfault or memory corruption messages in system logs (/var/log/syslog, dmesg) associated with the beam.smp process.
• Process: Sudden, unexpected termination of the beam.smp process; application supervisors restarting Erlang nodes repeatedly in a short time window.
• File System: Presence of new erl_crash.dump files with timestamps correlating to suspicious network activity; core dump files from the BEAM process if core dumps are enabled.

Upgrade to a patched version of Erlang/OTP: OTP 27.3.4.17 (for OTP 27.x), OTP 28.5.0.6 (for OTP 28.x), or OTP 29.0.6 (for OTP 29.x). For erts, the corresponding fixed versions are 15.2.7.13, 16.4.0.6, and 17.0.6 respectively. If immediate patching is not possible, apply the following workarounds: (1) Set the {packet_size, MaxPacketSize} option to a sensible value significantly less than 2^31 on all TCP ports using {packet,4} mode — this prevents the oversized allocation even if the overflow occurs; (2) Restrict network access to Erlang TCP ports using firewall rules so only trusted hosts can connect, eliminating the unauthenticated attack surface (GitHub Advisory).

The vulnerability was notably discovered by Claude, Anthropic's AI assistant, and triaged manually by Ada Logics in collaboration with Anthropic Research — a notable example of AI-assisted vulnerability discovery in a widely-used open-source runtime (GitHub Advisory). The CVE was included in Microsoft's September 2026 Patch Tuesday coverage due to its presence in Azure Linux (AZL3) Erlang packages, receiving broader industry attention through that channel (BleepingComputer). General community reaction has been measured, given the denial-of-service-only impact and the low feasibility of RCE.