A signed to unsigned conversion mismatch in Erlang OTP’s erts external term format decoder allows an attacker who can supply a crafted ETF binary to the binary_to_term/1 function to corrupt a BEAM heap pointer. The decoder validates the arity field as an unsigned 32‑bit integer during one pass and as a signed integer during decoding, permitting a negative arity that moves the heap allocation pointer backward and triggers an out‑of‑bounds heap write. The VM detects the inconsistency and aborts, resulting in a denial of service. No escalation of privileges or data exfiltration is possible; the impact is limited to service interruption of the vulnerable Erlang node.

The flaw affects the Erlang:OTP distribution. Systems running OTP versions 25.0 up through 27.3.4.15, 28.5.0.4, and any OTP build less than 29.0.4 are vulnerable. Corresponding erts releases from 13.0 up to 17.0.4, 16.4.0.4, and 15.2.7.11 are affected.

The CVSS score of 5.1 indicates medium severity. The EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog. An attacker only needs to transmit a malicious ETF payload to a vulnerable process; any Erlang node that processes untrusted ETF data can be targeted remotely for a denial of service attack. No privileged access is required, but the vulnerability can be exploited from outside the host if the process accepts external terms.