A classic buffer overflow occurs in the Erlang/OTP megaco flex scanner C driver when an attacker sends a single text-encoded H.248/Megaco message with an oversized property parameter name. During tokenization, the driver formats the attacker-controlled name into a 512‑byte error_msg buffer with an unchecked sprintf call; names longer than about 452 bytes overflow into adjacent structure fields such as text_buf, text_ptr, term_spec, term_spec_size, and term_spec_index, overwriting live pointers and counters. Subsequent scanner code then writes and frees through these corrupted pointers, creating arbitrary write and free primitives inside the BEAM VM process that can be leveraged for remote code execution; if compiled with _FORTIFY_SOURCE the overflow is detected and terminates the process with SIGABRT, resulting in denial of service. The overflow occurs before any grammar or authentication processing in the flex scanner, so exploitation requires only network reachability to the megaco transport port on a node configured with {scanner, flex}.

The affected product is Erlang/OTP, specifically OTP versions prior to 29.0.4, 28.5.0.4, and 27.3.4.15. These correspond to megaco versions 3.17.1 before 4.9.1, 4.8.3.1, and 4.7.2.2 respectively. Versions prior to OTP 17.0 are also impacted but are not listed because the version scheme starts at 17.0.

With a CVSS score of 8.3, this flaw poses a high severity. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, but the remote code execution capability and absence of mitigations in older releases make it a serious risk that should be addressed promptly. Exploitation requires only network reachability to the megaco transport port and no authentication, making it potentially feasible in environments that expose the Megaco service to untrusted networks.