{"affected":[{"defaultStatus":"unaffected","ecosystem":"software-id","packageName":"otp","product":"OTP","source":"CNA: EEF","vendor":"Erlang","versions":[{"changes":[{"at":"27.3.4.15","status":"unaffected"},{"at":"28.5.0.4","status":"unaffected"},{"at":"29.0.4","status":"unaffected"}],"lessThan":"*","status":"affected","version":"25.0","versionType":"otp"}]},{"defaultStatus":"unaffected","ecosystem":"otp","packageName":"erts","product":"OTP","source":"CNA: EEF","vendor":"Erlang","versions":[{"changes":[{"at":"15.2.7.11","status":"unaffected"},{"at":"16.4.0.4","status":"unaffected"},{"at":"17.0.4","status":"unaffected"}],"lessThan":"*","status":"affected","version":"13.0","versionType":"otp"}]},{"defaultStatus":"unaffected","ecosystem":"github","packageName":"erlang/otp","product":"OTP","source":"CNA: EEF","vendor":"Erlang","versions":[{"lessThan":"c5210b42a9d3d96f3d25601942ce8122be0f3761","status":"affected","version":"ebcbb97b4ec223464cac3d94375739a248ddef6e","versionType":"git"}]}],"cveId":"CVE-2026-55737","cwes":["CWE-195","CWE-787"],"description":"Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format (ETF) binary to binary_to_term/1 to corrupt the BEAM heap pointer and crash the virtual machine.\n\nWhen decoding a LARGE_TUPLE_EXT term, the validation pass decoded_size() in erts/emulator/beam/external.c reads the 32-bit arity field as unsigned (get_uint32()), while the decode pass dec_term() reads the same field as a signed 32-bit integer (get_int32()) into an int. An arity wire value of 0x80000000 passes validation as 2147483648 but decodes as -2147483648, so the subsequent hp += n moves the heap allocation pointer backward. Neither pass enforces the runtime tuple-arity limit MAX_ARITYVAL. The result is an out-of-bounds heap write; in practice the VM detects an impossible heap size and aborts, denying service. The required padding is large when uncompressed but the compressed-ETF envelope shrinks it to a small payload on the wire.\n\nThis issue affects OTP from OTP 25.0 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to erts from 13.0 before 15.2.7.11, 16.4.0.4, and 17.0.4.","epss":{"date":"2026-11-10","percentile":0.21544,"score":0.00288},"exploits":[],"kev":null,"metrics":[{"score":5.1,"severity":"medium","source":"CNA: EEF","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794422735184,"publishedAt":1785165234699,"references":[{"source":"CNA: EEF","tags":["vendor-advisory","related"],"url":"https://github.com/erlang/otp/security/advisories/GHSA-446w-268v-9462"},{"source":"CNA: EEF","tags":["related"],"url":"https://cna.erlef.org/cves/CVE-2026-55737.html"},{"source":"CNA: EEF","tags":["related"],"url":"https://osv.dev/vulnerability/EEF-CVE-2026-55737"},{"source":"CNA: EEF","tags":["x_version-scheme"],"url":"https://www.erlang.org/doc/system/versions.html#order-of-versions"},{"source":"CNA: EEF","tags":["related"],"url":"https://github.com/erlang/otp/commit/ebcbb97b4ec223464cac3d94375739a248ddef6e"},{"source":"CNA: EEF","tags":["patch"],"url":"https://github.com/erlang/otp/commit/c5210b42a9d3d96f3d25601942ce8122be0f3761"}],"remediation":[{"kind":"fix","source":"CNA: EEF","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/erlang/otp/commit/c5210b42a9d3d96f3d25601942ce8122be0f3761"}],"revision":"989e7f88259a537fb9944e600c91daaf870bcde9fc04daaa816a7fbfb5b327d4","sources":[{"modifiedAt":1794422735184,"name":"CNA: EEF","retrievedAt":1794424147842,"url":"https://www.cve.org/CVERecord?id=CVE-2026-55737"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794424163397,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55737"}],"ssvc":{"assessedAt":1785177285698,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder","updatedAt":1794424163397}