CVE-2026-75538: 
Erlang OTP vulnerability analysis and mitigation

CVE-2026-75538 is a signed integer overflow vulnerability in Erlang/OTP's inet TCP driver that allows an unauthenticated remote attacker to crash the BEAM VM via a heap-based buffer overflow. The flaw exists in the packet length calculation when the inet driver is configured with {packet,4} mode, enabling an attacker to overflow the receive buffer into the VM allocator area by up to approximately 2 GB. Affected versions span OTP 17.0 through 27.3.4.17, OTP 28.0 through 28.5.0.6, and OTP 29.0 through 29.0.6 (corresponding erts versions 6.0–15.2.7.13, 16.0–16.4.0.6, and 17.0–17.0.6); versions prior to OTP 17.0 may also be affected but their status is unknown. The vulnerability was published on September 1, 2026, and carries a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory, Microsoft MSRC).

The root cause is a signed integer overflow (CWE-190) in the packet_get_length() function within erts/emulator/beam/packet_parser.c, where the sum of the header length (hlen) and payload length (plen) could wrap around due to incorrect signed arithmetic, bypassing the wrap-around protection check. This leads to a heap-based buffer overflow (CWE-122) in tcp_expand_buffer() in inet_drv.c, where the computed buffer size underflows and causes the receive buffer to be allocated far too small, allowing subsequent data to overwrite the BEAM VM's allocator metadata and adjacent memory blocks. Exploitation requires the target TCP port to be using the {packet,4} mode and to be reachable from an untrusted network — no authentication is required. The fix, committed as 08e8efd, replaces the flawed signed arithmetic with explicit overflow checks before performing the addition (GitHub Commit, GitHub Advisory). The vulnerability was discovered by Claude (Anthropic's AI assistant) and triaged by Ada Logics in collaboration with Anthropic Research.

Successful exploitation causes the BEAM VM to crash, resulting in a complete denial of service for any application running on the affected Erlang/OTP node. The overflow corrupts the allocator metadata footer of the allocated block and potentially the next adjacent memory block, making a controlled crash the most likely outcome. Remote code execution is theoretically possible but considered extremely unfeasible due to the imprecision required to exploit the memory corruption with sufficient control. There is no impact on confidentiality or integrity of data (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The NVD SSVC assessment classifies exploitation as "none" and the attack as not automatable. The EPSS score is approximately 0.49%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify Erlang/OTP services with exposed TCP ports configured in {packet,4} mode using network scanning tools such as Shodan, Censys, or nmap, targeting services like RabbitMQ, CouchDB, or custom Erlang applications.
2. Connect to the target port: Establish a raw TCP connection to the identified open Erlang TCP port without any authentication.
3. Craft a malicious packet: Construct a 4-byte packet header containing a length value that, when added to the header length (4 bytes), causes a signed integer overflow — specifically, a value close to or exceeding INT_MAX - 4 (e.g., 0x7FFFFFFC or higher) encoded as a big-endian 32-bit integer.
4. Send the malformed packet: Transmit the crafted packet to the target. The vulnerable packet_get_length() function performs the signed addition without proper overflow checking, producing a negative or very small total length value that bypasses the wrap-around guard.
5. Trigger buffer overflow: The tcp_expand_buffer() function allocates a buffer based on the corrupted length, causing subsequent data to overflow into the BEAM VM allocator area, corrupting allocator metadata and crashing the VM (GitHub Advisory, GitHub Commit).

• Network: Unexpected TCP connections to Erlang service ports from untrusted or external IP addresses; single-packet connections that immediately terminate after sending a 4-byte header with a near-maximum integer value.
• Logs: Erlang crash dump files (erl_crash.dump) generated unexpectedly in the application working directory; BEAM VM crash reports in system logs (e.g., syslog, journald) with memory corruption or segmentation fault indicators.
• Process: Sudden termination of the BEAM VM process (beam.smp or beam) without a graceful shutdown signal; application supervisors restarting Erlang nodes unexpectedly.
• File System: Presence of new or recently modified erl_crash.dump files, which contain a snapshot of the VM state at the time of the crash and may include the malformed packet data in memory traces.

Upgrade to one of the patched OTP releases: OTP 27.3.4.17 (for OTP 27.x), OTP 28.5.0.6 (for OTP 28.x), or OTP 29.0.6 (for OTP 29.x), corresponding to erts versions 15.2.7.13, 16.4.0.6, and 17.0.6 respectively (GitHub Advisory). As an immediate workaround without patching, set the {packet_size, MaxPacketSize} socket option to a sensible value significantly less than 2^31 to prevent the driver from attempting to allocate excessively large buffers. Alternatively, avoid using {packet,4} mode on TCP ports that are reachable from untrusted entities, or restrict network access to Erlang TCP ports to trusted hosts only using firewall rules.

The vulnerability was notably discovered by Claude, Anthropic's AI assistant, and triaged manually by Ada Logics in collaboration with Anthropic Research — a notable example of AI-assisted vulnerability discovery in a widely-used open-source runtime (GitHub Advisory). The vulnerability was included in Microsoft's September 2026 Patch Tuesday coverage due to its impact on Azure Linux packages containing Erlang (BleepingComputer).