The vulnerability is a stack‑based buffer overflow in the ei_s_print_term routine of the Erlang OTP erl_interface module. When an encoded Erlang term containing a very large integer—whose encoded representation exceeds 2000 characters—is processed, an internal 2000‑character stack buffer is overrun. The overflowing bytes are restricted to the ASCII characters 0–9 and A–F, which limits the flaw to a denial‑of‑service scenario rather than arbitrary code execution.

The issue occurs in Erlang OTP releases prior to OTP 27.3.4.13, 28.5.0.2, and 29.0.2, which correspond to erl_interface versions before 5.5.2.1, 5.7.0.1, and 5.8.1 respectively. Any installation of OTP 17.0 through 27.3.4.12, 28.5.0.1, or 29.0.1 that still uses those erl_interface releases is affected.

The CVSS score of 6.9 indicates a moderate severity, and the problem does not appear in the KEV catalog, with the EPSS score listed as not available. Because the overflowing buffer can be reached only when an attacker controls the encoded integer representation, the likely attack vector is local or within a trusted network context. The limited payload space and the resulting denial‑of‑service impact constrain the exploit to crashing the node or process that invoked ei_s_print_term, rather than granting remote code execution.