CVE-2026-54890 - Vulnerability Details

- BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding

Description

Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.

The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as "Cannot allocate 2305843009213693951 bytes of memory (of type binary)".

The crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).

Any application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).

This issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.

Published: 2026-07-27

Score: 8.2 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability triggers an integer underflow when decoding the BIT_BINARY_EXT tag in the External Term Format, causing the BEAM virtual machine to attempt an allocation of an astronomically large size (approximately 2¹⁶⁴ bytes). This results in a VM‑level abort that cannot be trapped by application supervision trees or exception handling, resulting in an immediate node crash and denial of service.

Affected Systems

The flaw is present in Erlang/OTP releases prior to OTP 29.0.4, specifically OTP 27.0, 27.3.4.15 and 28.5.0.4, which incorporate erts 15.0, 15.2.7.11 and 16.4.0.4. The affected product is the Erlang/OTP runtime (erlang:otp).

Risk and Exploitability

With a CVSS score of 8.2 the vulnerability is considered high severity. An attacker who can supply malformed ETF data—either through applications that invoke binary_to_term or enif_binary_to_term, or via the Erlang distribution protocol on networks not deemed trusted per OTP Secure Coding Guidelines—can trigger the crash. The EPSS score of <1% indicates a very low but nonzero probability of exploitation, and the vulnerability is not listed in CISA KEV. The lack of runtime detectability and the inability to recover from the abort mean the potential impact is substantial if external data is processed.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Erlang

OTP

unaffected

Version	Status	Constraints
`15.0`	affected	< *

Erlang

OTP

unaffected

Version	Status	Constraints
`27.0`	affected	< *
`24ef4cbaeda9b9c26682cba75f2f15b0c58722aa`	affected	< dc1bf9344c0ce62717cf60866590cea0242780fd

Configuration 1 [-]

OR	cpe:2.3:a:erlang:erlang\/otp::::::::
	cpe:2.3:a:erlang:erlang\/otp::::::::
	cpe:2.3:a:erlang:erlang\/otp::::::::
	cpe:2.3:a:erlang:erts::::::::
	cpe:2.3:a:erlang:erts::::::::
	cpe:2.3:a:erlang:erts::::::::

No data.

Vendor Product Confidence Versions

Erlang

Erlang/otp

95%

Version	Status	Scheme	Platform
`[15.0,*]`	affected	generic	—
`[27.0,*]`	affected	generic	—
`[24ef4cbaeda9b9c26682cba75f2f15b0c58722aa,dc1bf9344c0ce62717cf60866590cea0242780fd)`	affected	code_commit	—

Erlang

Otp

100%

Version	Status	Scheme	Platform
`[15.0,*]`	affected	generic	—

Erlang

Otp

100%

Version	Status	Scheme	Platform
`[27.0,*]`	affected	generic	—
`[24ef4cbaeda9b9c26682cba75f2f15b0c58722aa,dc1bf9344c0ce62717cf60866590cea0242780fd)`	affected	code_commit	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

Vendor Workaround

Do not call binary_to_term/1,2 or enif_binary_to_term() on data from untrusted sources. The OTP Secure Coding Guidelines (DSG-011) recommend avoiding these functions altogether on untrusted input and using an alternative serialization format (for example JSON or Protocol Buffers) instead.

OpenCVE Recommended Actions

Upgrade Erlang/OTP to version 29.0.4 or newer.
Avoid using binary_to_term/1,2 or enif_binary_to_term with data from untrusted sources; switch to a safer serialization format such as JSON or Protocol Buffers.
Ensure that Erlang distribution communications occur only over trusted networks or, if unavoidable, isolate the distribution interface and monitor for anomalous binary data.

Generated by OpenCVE AI on August 3, 2026 at 17:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00385.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cna.erlef.org/cves/CVE-2026-54890.html
https://github.com/erlang/otp/commit/dc1bf9344c0ce62717cf60866590cea0242780fd
https://github.com/erlang/otp/security/advisories/GHSA-54pw-5645-jh86
https://nvd.nist.gov/vuln/detail/CVE-2026-54890
https://osv.dev/vulnerability/EEF-CVE-2026-54890
https://www.cve.org/CVERecord?id=CVE-2026-54890
https://www.erlang.org/doc/system/versions.html#order-of-versions

History

Wed, 29 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-54890 https://www.cve.org/CVERecord?id=CVE-2026-54890
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Mon, 27 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Erlang erlang/otp Erlang otp
Vendors & Products		Erlang erlang/otp Erlang otp
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 27 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c. The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as "Cannot allocate 2305843009213693951 bytes of memory (of type binary)". The crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings). Any application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011). This issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.
Title		BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding
First Time appeared		Erlang Erlang erlang\/otp
Weaknesses		CWE-1284 CWE-191 CWE-789
CPEs		cpe:2.3:a:erlang:erlang\/otp::::::::
Vendors & Products		Erlang Erlang erlang\/otp
References		https://cna.erlef.org/cves/CVE-2026-54890.html https://github.com/erlang/otp/commit/dc1bf9344c0ce62717cf60866590cea0242780fd https://github.com/erlang/otp/security/advisories/GHSA-54pw-5645-jh86 https://osv.dev/vulnerability/EEF-CVE-2026-54890 https://www.erlang.org/doc/system/versions.html#order-of-versions
Metrics		cvssV4_0 `{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

Erlang Erlang/otp Erlang\/otp Erts Otp

MITRE

Status: PUBLISHED

Assigner: EEF

Published: 2026-07-27T15:39:03.475Z

Updated: 2026-07-28T09:55:08.138Z

Reserved: 2026-06-16T10:47:13.915Z

Link: CVE-2026-54890

Vulnrichment

Updated: 2026-07-27T18:19:03.450Z

NVD

Status : Analyzed

Published: 2026-07-27T16:17:41.437

Modified: 2026-08-10T20:25:42.790

Link: CVE-2026-54890

Redhat

Severity : Important

Publid Date: 2026-07-27T15:39:03Z

Links: CVE-2026-54890 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-03T17:15:12Z

Weaknesses

CWE-1284
Improper Validation of Specified Quantity in Input
CWE-191
Integer Underflow (Wrap or Wraparound)
CWE-789
Memory Allocation with Excessive Size Value

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object