A signed integer overflow in Erlang/OTP's inet TCP driver allows an unauthenticated attacker to send a specially crafted packet to a service running with {packet,4} mode. The overflow corrupts the receive buffer and propagates the overflow into the BEAM VM's allocator metadata up to around 2 GB, which in practice causes the BEAM VM to crash. The vulnerability does not provide a straightforward remote code execution path, so its primary impact is a denial‑of‑service on the affected node.

The flaw is present in Erlang/OTP releases up to OTP 27.3.4.17, up to OTP 28.5.0.6, and up to OTP 29.0.6, including the corresponding erts releases before these patch points. In short, any Erlang/OTP install that does not incorporate the commit fixing the overflow is potentially vulnerable.

The CVSS score of 8.2 labels the issue as high severity, and despite the EPSS score being unavailable the nature of the overflow indicates a non‑trivial exploit effort. The vulnerability is publicly exploitable over an open network port, but the lack of a reliable remote‑code‑execution path and the need for precise packet crafting reduce the likelihood of large‑scale deployment. It is not listed in the CISA KEV catalog, which further suggests that no widespread active exploitation has been observed yet.