Executive brief
A memory safety vulnerability exists in the Erlang/OTP Megaco component, which is used to handle gateway control protocols in telecommunications. By sending a specially crafted network message, an unauthenticated attacker can crash the service or potentially take control of the underlying system. This issue specifically affects systems configured to use the high-performance 'flex scanner' for processing text-encoded messages.
Technical details
A classic buffer overflow exists in the Megaco flex scanner C driver (megaco_flex_scanner_drv) within Erlang/OTP. The vulnerability is located in the mfs_load_property_groups routine, where an unchecked sprintf call formats an attacker-controlled property name into a fixed 512-byte buffer (error_msg) when no value follows the property. An input longer than approximately 452 bytes overflows into adjacent struct fields, including text_ptr and term_spec, allowing for the corruption of live pointers. This can be exploited to achieve arbitrary write and arbitrary free primitives within the BEAM VM. The vulnerability is reachable pre-authentication over the network if the Megaco stack is configured with the {scanner, flex} option. Patches are available in OTP versions 29.0.4, 28.5.0.4, and 27.3.4.15.
Affected products
- Erlang OTP 17.0 to 27.3.4.14, 28.0 to 28.5.0.3, 29.0 to 29.0.3
- Erlang megaco 3.17.1 to 4.7.2.1, 4.8.0 to 4.8.3.0, 4.9.0
Timeline
- 2026-07-27: advisory
- 2026-07-27: disclosed