UpHeron
All vulnerabilities

Servers and applications

CVE-2026-55737

Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format (ETF) binary to binary_to_term/1 to corrupt the BEAM heap pointer and crash the virtual machine. When decoding a LARGE_TUPLE_EXT term, the validation pass decoded_size() in erts/emulator/beam/external.c reads the 32-bit arity field…

Severity
Medium 5.1
Published
27 Jul 2026
Last changed
10 Aug 2026
Added to UpHeron
16 Oct 2026
Fixed in
27.3.4.15, 28.5.0.4, 29.0.4
Sources
NVD

Affected software

SoftwareAffected versions
Erlang/OTPServers and applications · cpe:a:erlang:erlang\/otp
  • From 25.0 before 27.3.4.15
  • From 28.0 before 28.5.0.4
  • From 29.0 before 29.0.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-55737
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-55737