Is CVE-2026-59250 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59250 being exploited in the wild.

How severe is CVE-2026-59250?

Informational severity, with a CVSS score of 8.3, published 27 July 2026.

Which products and versions are affected?

Erlang Megaco 3.17.1 to 4.7.2.1, 4.8.0 to 4.8.3.0, 4.9.0; Erlang OTP 17.0 to 27.3.4.14, 28.0 to 28.5.0.3, 29.0 to 29.0.3.

Is there a fix for CVE-2026-59250?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-59250 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59250?

Check whether you run Erlang Megaco or Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59250: Erlang OTP buffer overflow in Megaco flex scanner

CVE-2026-59250 · Severity: info · CVSS 8.3 · Published 2026-07-27

A memory safety vulnerability exists in the Erlang/OTP Megaco component, which is used to handle gateway control protocols in telecommunications. By sending a specially crafted network message, an unauthenticated attacker can crash the service or potentially take control of the underlying system. This issue specifically affects systems configured to use the high-performance 'flex scanner' for processing text-encoded messages.

Technologies: Erlang OTP. Vendors: Erlang.

Quick answers

Is CVE-2026-59250 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59250 being exploited in the wild.
How severe is CVE-2026-59250?: Informational severity, with a CVSS score of 8.3, published 27 July 2026.
Which products and versions are affected?: Erlang Megaco 3.17.1 to 4.7.2.1, 4.8.0 to 4.8.3.0, 4.9.0; Erlang OTP 17.0 to 27.3.4.14, 28.0 to 28.5.0.3, 29.0 to 29.0.3.
Is there a fix for CVE-2026-59250?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-59250 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59250?: Check whether you run Erlang Megaco or Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A classic buffer overflow exists in the Megaco flex scanner C driver (megaco_flex_scanner_drv) within Erlang/OTP. The vulnerability is located in the mfs_load_property_groups routine, where an unchecked sprintf call formats an attacker-controlled property name into a fixed 512-byte buffer (error_msg) when no value follows the property. An input longer than approximately 452 bytes overflows into adjacent struct fields, including text_ptr and term_spec, allowing for the corruption of live pointers. This can be exploited to achieve arbitrary write and arbitrary free primitives within the BEAM VM. The vulnerability is reachable pre-authentication over the network if the Megaco stack is configured with the {scanner, flex} option. Patches are available in OTP versions 29.0.4, 28.5.0.4, and 27.3.4.15.

Affected products

Erlang OTP 17.0 to 27.3.4.14, 28.0 to 28.5.0.3, 29.0 to 29.0.3
Erlang megaco 3.17.1 to 4.7.2.1, 4.8.0 to 4.8.3.0, 4.9.0

Timeline

2026-07-27: advisory
2026-07-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.