CVE-2026-59250: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-59250 is a classic buffer overflow vulnerability in the Erlang/OTP megaco flex scanner C driver that allows a remote unauthenticated attacker to crash the BEAM VM process or potentially achieve remote code execution by sending a single crafted H.248/Megaco message. The vulnerability was discovered by Jonatan Männchen at the Erlang Ecosystem Foundation (EEF) and disclosed on July 27, 2026. Affected versions include Erlang/OTP megaco >= 3.17.1 (unpatched), with patched versions released as OTP 29.0.4, 28.5.0.4, and 27.3.4.15 (megaco 4.9.1, 4.8.3.1, and 4.7.2.2 respectively); versions prior to OTP 17.0 are also affected. The CVSS v4 base score is 8.3 (High) (GitHub Advisory).

The root cause is an unchecked sprintf call (CWE-120, CWE-787) in the mfs_load_property_groups function within the megaco flex scanner C driver (megaco_flex_scanner_drv.flex.src). When tokenizing a Local/Remote descriptor, the function extracts an attacker-controlled property parm name and formats it into a fixed 512-byte error_msg field of the MfsErlDrvData struct using sprintf without bounds checking. Property names longer than approximately 452 bytes overflow into adjacent struct fields (text_buf, text_ptr, term_spec, term_spec_size, term_spec_index), overwriting live pointers and counters with attacker-controlled bytes. Subsequent scanner operations write and free through the corrupted pointers, yielding arbitrary write and arbitrary free primitives inside the BEAM VM process. The overflow is reachable pre-authentication — the flex scanner processes the raw TCP payload before any Megaco protocol-level validation — and requires only network reachability to the megaco transport port on a node configured with {scanner, flex} (GitHub Advisory, GitHub Commit).

On OTP 28.0+ systems where _FORTIFY_SOURCE is enabled by default, the overflow is detected at runtime and terminates the BEAM VM process with SIGABRT, resulting in a complete denial of service of the Erlang node. On OTP 27.x and earlier (where _FORTIFY_SOURCE is not enabled by the build system), the corrupted pointers can be leveraged for arbitrary write and arbitrary free primitives, potentially enabling remote code execution within the BEAM VM process. A single unauthenticated network packet is sufficient to trigger the crash, making availability impact severe; confidentiality impact is rated None and integrity impact is rated Low under CVSS v4 (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). The NVD SSVC assessment rates exploitation as "none" and the vulnerability as not automatable. The EPSS score is 0.0073 (approximately 0.73%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the target node to be configured with the flex scanner option ({scanner, flex}) and the megaco transport port to be network-reachable (GitHub Advisory).

1. Reconnaissance: Identify Erlang/OTP nodes running the megaco application with the flex scanner enabled ({scanner, flex}). Scan for open megaco transport ports (commonly TCP 2944 for text encoding) using tools like Nmap or Shodan.
2. Confirm vulnerability: Verify the target is running an unpatched OTP version (prior to 29.0.4, 28.5.0.4, or 27.3.4.15) by banner analysis or version fingerprinting if available.
3. Craft malicious H.248/Megaco message: Construct a text-encoded H.248/Megaco message containing a Local or Remote descriptor with a property parm name exceeding 452 bytes (e.g., a name field padded to 500+ bytes with arbitrary characters).
4. Send the message: Transmit the single crafted message to the megaco transport port. No authentication or prior session establishment is required — the flex scanner processes the raw TCP payload before any protocol-level validation.
5. Trigger overflow: The mfs_load_property_groups function passes the oversized name to sprintf, overflowing the 512-byte error_msg buffer and corrupting adjacent struct fields.
6. Achieve impact: On FORTIFY-enabled builds (OTP 28.0+), the process terminates with SIGABRT (DoS). On older builds without FORTIFY, corrupted pointers enable arbitrary write/free primitives that can be further developed into remote code execution within the BEAM VM process (GitHub Advisory, GitHub Commit).

• Network: Single inbound TCP connection to the megaco transport port (commonly 2944) delivering a text-encoded H.248/Megaco message with an unusually long property parm name (>452 bytes) in a Local/Remote descriptor; anomalous short-lived connections from unexpected source IPs to the megaco port.
• Process: Unexpected termination of the BEAM VM (beam.smp) process; SIGABRT signal recorded for the Erlang runtime process on FORTIFY-enabled systems.
• Logs: OS-level crash reports or core dumps associated with the beam.smp process; system logs showing SIGABRT or segmentation fault for the Erlang node process; Erlang crash dump files (erl_crash.dump) generated in the working directory of the node.
• File System: Presence of erl_crash.dump files with timestamps correlating to unexpected node restarts; core dump files from the BEAM VM process.

Erlang/OTP has released patched versions: OTP 29.0.4, OTP 28.5.0.4, and OTP 27.3.4.15 (corresponding megaco library versions 4.9.1, 4.8.3.1, and 4.7.2.2). The fix replaces all unchecked sprintf calls in mfs_load_property_groups and mfs_alloc_failed with bounds-checked snprintf calls using sizeof(dataP->error_msg) (GitHub Commit). For systems that cannot be patched immediately, two workarounds are available: (1) switch from the flex scanner to the Erlang-based scanner by removing {scanner, flex} from the megaco encoder configuration (note: this incurs a performance cost but eliminates the C-level vulnerability); (2) restrict network access to the megaco transport port using firewall rules or ACLs to allow only trusted signalling peers (GitHub Advisory).

The vulnerability was responsibly disclosed by Jonatan Männchen of the Erlang Ecosystem Foundation (EEF) to the Erlang/OTP project, with remediation developed by contributor u3s and reviewed by bmk. Security aggregators including SecurityOnline.info, VulnDB, and INCIBE-CERT published coverage shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified at this time (GitHub Advisory, SecurityOnline).