Stack-based buffer overflow vulnerability exists in Erlang OTP erts’s inet_drv SCTP error chunk parser. A remote attacker who has established an SCTP association to a listening port can send a crafted SCTP ERROR chunk containing many 16‑bit cause codes. The sctp_parse_error_chunk function writes these codes into a fixed-size stack‑allocated spec[] array without performing bounds checking, causing the BEAM VM to crash. Because the data consists only of interleaved tags and 16‑bit values, the overflow does not corrupt a return address, limiting exploitation to denial of service. An attacker may also leak fragments of Erlang VM memory into the error packet returned to the sending Erlang process, but this disclosure is limited to data already readable by the VM user.

All Erlang OTP releases from 170 through 29.0.1, including OTP 28.5.0.2 and 27.3.4.13, and the corresponding Erlang runtime system releases 6.0 through 15.2.7.9, plus 16.4.0.2, are vulnerable; the issue is recorded under the Erlang:OTP product family.

The CVSS score of 8.8 indicates a high severity denial of service flaw. The EPSS score of < 1% indicates a very low probability of exploitation, but the absence of a requirement for privileged access or authentication suggests the attack vector is network based, via an SCTP association to a listening port. The vulnerability is not listed in CISA’s KEV catalog and currently has no known exploits in the wild.