{"affected":[{"defaultStatus":"unaffected","ecosystem":"software-id","packageName":"otp","product":"OTP","source":"CNA: EEF","vendor":"Erlang","versions":[{"changes":[{"at":"27.3.4.15","status":"unaffected"},{"at":"28.5.0.4","status":"unaffected"},{"at":"29.0.4","status":"unaffected"}],"lessThan":"*","status":"affected","version":"27.0","versionType":"otp"}]},{"defaultStatus":"unaffected","ecosystem":"otp","packageName":"erts","product":"OTP","source":"CNA: EEF","vendor":"Erlang","versions":[{"changes":[{"at":"15.2.7.11","status":"unaffected"},{"at":"16.4.0.4","status":"unaffected"},{"at":"17.0.4","status":"unaffected"}],"lessThan":"*","status":"affected","version":"15.0","versionType":"otp"}]},{"defaultStatus":"unaffected","ecosystem":"github","packageName":"erlang/otp","product":"OTP","source":"CNA: EEF","vendor":"Erlang","versions":[{"lessThan":"dc1bf9344c0ce62717cf60866590cea0242780fd","status":"affected","version":"24ef4cbaeda9b9c26682cba75f2f15b0c58722aa","versionType":"git"}]}],"cveId":"CVE-2026-54890","cwes":["CWE-191","CWE-789","CWE-1284"],"description":"Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.\n\nThe BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as Cannot allocate 2305843009213693951 bytes of memory (of type \"binary\").\n\nThe crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).\n\nAny application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).\n\nThis issue affects OTP from OTP 27.0 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to erts from 15.0 before 15.2.7.11, 16.4.0.4, and 17.0.4.","epss":{"date":"2026-11-10","percentile":0.36667,"score":0.0042},"exploits":[],"kev":null,"metrics":[{"score":8.2,"severity":"high","source":"CNA: EEF","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794422864385,"publishedAt":1785166743475,"references":[{"source":"CNA: EEF","tags":["vendor-advisory","related"],"url":"https://github.com/erlang/otp/security/advisories/GHSA-54pw-5645-jh86"},{"source":"CNA: EEF","tags":["related"],"url":"https://cna.erlef.org/cves/CVE-2026-54890.html"},{"source":"CNA: EEF","tags":["related"],"url":"https://osv.dev/vulnerability/EEF-CVE-2026-54890"},{"source":"CNA: EEF","tags":["x_version-scheme"],"url":"https://www.erlang.org/doc/system/versions.html#order-of-versions"},{"source":"CNA: EEF","tags":["related"],"url":"https://github.com/erlang/otp/commit/24ef4cbaeda9b9c26682cba75f2f15b0c58722aa"},{"source":"CNA: EEF","tags":["patch"],"url":"https://github.com/erlang/otp/commit/dc1bf9344c0ce62717cf60866590cea0242780fd"}],"remediation":[{"kind":"workaround","source":"CNA: EEF","text":"Do not call binary_to_term/1,2 or enif_binary_to_term() on data from untrusted sources. The OTP Secure Coding Guidelines (DSG-011) recommend avoiding these functions altogether on untrusted input and using an alternative serialization format (for example JSON or Protocol Buffers) instead."},{"kind":"fix","source":"CNA: EEF","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/erlang/otp/commit/dc1bf9344c0ce62717cf60866590cea0242780fd"}],"revision":"31be2dcfad2207c75396df8b0074756a3c4344e40570e7d403d2069662ee6d45","sources":[{"modifiedAt":1794422864385,"name":"CNA: EEF","retrievedAt":1794424146729,"url":"https://www.cve.org/CVERecord?id=CVE-2026-54890"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794424163533,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54890"}],"ssvc":{"assessedAt":1785176337223,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding","updatedAt":1794424163533}