Description
Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (and potentially achieve remote code execution or a denial-of-service crash) by sending a single text-encoded H.248/Megaco message containing an oversized property parm name.

When tokenizing a Local/Remote descriptor, mfs_load_property_groups extracts the attacker-controlled property name (bounded only by the message length) and, when no value follows, formats it into a fixed 512-byte error_msg field of the MfsErlDrvData struct using an unchecked sprintf call. Names longer than roughly 452 bytes overflow into the immediately following struct fields (text_buf, text_ptr, term_spec, term_spec_size, term_spec_index), overwriting live pointers and counters with attacker-chosen bytes. Subsequent scanner code writes and frees through the corrupted pointers, producing arbitrary write and arbitrary free primitives inside the BEAM VM process, which can be leveraged for remote code execution. On builds compiled with _FORTIFY_SOURCE the overflow is detected at runtime and terminates the process with SIGABRT, resulting in denial of service.

The overflow occurs in the flex scanner before any grammar or Megaco-level authentication processing, so exploitation requires only network reachability to the megaco transport port on a node configured with {scanner, flex}.

This vulnerability is associated with program files lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src and program routines mfs_load_property_groups.

This issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to megaco from 3.17.1 before 4.9.1, 4.8.3.1 and 4.7.2.2. Versions prior to OTP 17.0 are also affected but are not listed because the OTP version scheme is only defined from OTP 17.0 onwards.
Published: 2026-07-27
Score: 8.3 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A classic buffer overflow exists in the Erlang/OTP megaco flex scanner C driver. The vulnerability allows a remote, unauthenticated attacker to send a single text-encoded H.248/Megaco message containing an oversized property parameter name, causing uncontrolled memory writes that can lead to arbitrary code execution or a denial-of-service crash. The flaw manifests when the driver formats an overly long property name into a fixed 512-byte buffer using an unchecked sprintf call, overwriting adjacent pointers and counters and creating arbitrary write and free primitives within the BEAM VM process.

Affected Systems

The affected product is Erlang/OTP, specifically OTP versions before 29.0.4, 28.5.0.4, and 27.3.4.15. These correspond to megaco versions 3.17.1 before 4.9.1, 4.8.3.1, and 4.7.2.2 respectively. Versions prior to OTP 17.0 are also impacted but are not listed because the version scheme starts at 17.0.

Risk and Exploitability

With a CVSS score of 8.3, this flaw poses a high severity. Exponential exploitation requires only network reachability to the megaco transport port and no authentication. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, but the remote code execution capability and absence of mitigations in older releases make it a serious risk that should be addressed promptly.

Generated by OpenCVE AI on August 3, 2026 at 17:15 UTC.

Remediation

Vendor Workaround

Switch the megaco text codec to the default Erlang-based scanner by removing {scanner, flex} from the encoder configuration. The Erlang scanner is not affected by this C-level memory corruption, at the cost of reduced parsing throughput.

OpenCVE Recommended Actions

  • Upgrade to Erlang/OTP 29.0.4 or newer (or 28.5.0.4/27.3.4.15) to apply the official buffer-overflow fix.
  • If an upgrade is not possible, modify the megaco encoder configuration to remove `{scanner, flex}` so that the Erlang scanner is used; this disables the vulnerable flex scanner but reduces parsing throughput.
  • Continuously monitor Erlang/OTP advisories for subsequent patches or additional mitigations.

Generated by OpenCVE AI on August 3, 2026 at 17:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Erlang erlang/otp
Vendors & Products Erlang erlang/otp

Mon, 27 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Description Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (and potentially achieve remote code execution or a denial-of-service crash) by sending a single text-encoded H.248/Megaco message containing an oversized property parm name. When tokenizing a Local/Remote descriptor, mfs_load_property_groups extracts the attacker-controlled property name (bounded only by the message length) and, when no value follows, formats it into a fixed 512-byte error_msg field of the MfsErlDrvData struct using an unchecked sprintf call. Names longer than roughly 452 bytes overflow into the immediately following struct fields (text_buf, text_ptr, term_spec, term_spec_size, term_spec_index), overwriting live pointers and counters with attacker-chosen bytes. Subsequent scanner code writes and frees through the corrupted pointers, producing arbitrary write and arbitrary free primitives inside the BEAM VM process, which can be leveraged for remote code execution. On builds compiled with _FORTIFY_SOURCE the overflow is detected at runtime and terminates the process with SIGABRT, resulting in denial of service. The overflow occurs in the flex scanner before any grammar or Megaco-level authentication processing, so exploitation requires only network reachability to the megaco transport port on a node configured with {scanner, flex}. This vulnerability is associated with program files lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src and program routines mfs_load_property_groups. This issue affects OTP from OTP 17.0 until OTP 29.0.4, 28.5.0.4, and 27.3.4.15 corresponding to megaco from 3.17.1 until 4.9.1, 4.8.3.1, and 4.7.2.2. Versions prior to OTP 17.0 are also affected but are not listed because the OTP version scheme is only defined from OTP 17.0 onwards. Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (and potentially achieve remote code execution or a denial-of-service crash) by sending a single text-encoded H.248/Megaco message containing an oversized property parm name. When tokenizing a Local/Remote descriptor, mfs_load_property_groups extracts the attacker-controlled property name (bounded only by the message length) and, when no value follows, formats it into a fixed 512-byte error_msg field of the MfsErlDrvData struct using an unchecked sprintf call. Names longer than roughly 452 bytes overflow into the immediately following struct fields (text_buf, text_ptr, term_spec, term_spec_size, term_spec_index), overwriting live pointers and counters with attacker-chosen bytes. Subsequent scanner code writes and frees through the corrupted pointers, producing arbitrary write and arbitrary free primitives inside the BEAM VM process, which can be leveraged for remote code execution. On builds compiled with _FORTIFY_SOURCE the overflow is detected at runtime and terminates the process with SIGABRT, resulting in denial of service. The overflow occurs in the flex scanner before any grammar or Megaco-level authentication processing, so exploitation requires only network reachability to the megaco transport port on a node configured with {scanner, flex}. This vulnerability is associated with program files lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src and program routines mfs_load_property_groups. This issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to megaco from 3.17.1 before 4.9.1, 4.8.3.1 and 4.7.2.2. Versions prior to OTP 17.0 are also affected but are not listed because the OTP version scheme is only defined from OTP 17.0 onwards.

Mon, 27 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Description Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (and potentially achieve remote code execution or a denial-of-service crash) by sending a single text-encoded H.248/Megaco message containing an oversized property parm name. When tokenizing a Local/Remote descriptor, mfs_load_property_groups extracts the attacker-controlled property name (bounded only by the message length) and, when no value follows, formats it into a fixed 512-byte error_msg field of the MfsErlDrvData struct using an unchecked sprintf call. Names longer than roughly 452 bytes overflow into the immediately following struct fields (text_buf, text_ptr, term_spec, term_spec_size, term_spec_index), overwriting live pointers and counters with attacker-chosen bytes. Subsequent scanner code writes and frees through the corrupted pointers, producing arbitrary write and arbitrary free primitives inside the BEAM VM process, which can be leveraged for remote code execution. On builds compiled with _FORTIFY_SOURCE the overflow is detected at runtime and terminates the process with SIGABRT, resulting in denial of service. The overflow occurs in the flex scanner before any grammar or Megaco-level authentication processing, so exploitation requires only network reachability to the megaco transport port on a node configured with {scanner, flex}. This vulnerability is associated with program files lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src and program routines mfs_load_property_groups. This issue affects OTP from OTP 17.0 until OTP 29.0.4, 28.5.0.4, and 27.3.4.15 corresponding to megaco from 3.17.1 until 4.9.1, 4.8.3.1, and 4.7.2.2. Versions prior to OTP 17.0 are also affected but are not listed because the OTP version scheme is only defined from OTP 17.0 onwards.
Title Megaco flex scanner buffer overflow via oversized property parm name
First Time appeared Erlang
Erlang erlang\/otp
Weaknesses CWE-120
CWE-787
CPEs cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Vendors & Products Erlang
Erlang erlang\/otp
References
Metrics cvssV4_0

{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Erlang Erlang/otp Erlang\/otp
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-07-28T09:55:21.416Z

Reserved: 2026-07-04T04:24:03.653Z

Link: CVE-2026-59250

cve-icon Vulnrichment

Updated: 2026-07-27T18:33:10.223Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-07-27T16:18:03.330

Modified: 2026-07-30T17:01:07.343

Link: CVE-2026-59250

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T17:15:12Z

Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  • CWE-787

    Out-of-bounds Write