# CVE-2026-59250: Erlang OTP buffer overflow in Megaco flex scanner

Source: https://junglewise.ai/threats/cve-2026-59250-erlang-otp-buffer-overflow-in-megaco-flex-scanner  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2026-59250 · Severity: info · CVSS 8.3 · Published 2026-07-27

A memory safety vulnerability exists in the Erlang/OTP Megaco component, which is used to handle gateway control protocols in telecommunications. By sending a specially crafted network message, an unauthenticated attacker can crash the service or potentially take control of the underlying system. This issue specifically affects systems configured to use the high-performance 'flex scanner' for processing text-encoded messages.

Technologies: [Erlang OTP](https://junglewise.ai/threats/technologies/otp). Vendors: [Erlang](https://junglewise.ai/threats/vendors/erlang).

## Quick answers

**Is CVE-2026-59250 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59250 being exploited in the wild.

**How severe is CVE-2026-59250?** Informational severity, with a CVSS score of 8.3, published 27 July 2026.

**Which products and versions are affected?** Erlang Megaco 3.17.1 to 4.7.2.1, 4.8.0 to 4.8.3.0, 4.9.0; Erlang OTP 17.0 to 27.3.4.14, 28.0 to 28.5.0.3, 29.0 to 29.0.3.

**Is there a fix for CVE-2026-59250?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-59250 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59250?** Check whether you run Erlang Megaco or Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A classic buffer overflow exists in the Megaco flex scanner C driver (megaco_flex_scanner_drv) within Erlang/OTP. The vulnerability is located in the mfs_load_property_groups routine, where an unchecked sprintf call formats an attacker-controlled property name into a fixed 512-byte buffer (error_msg) when no value follows the property. An input longer than approximately 452 bytes overflows into adjacent struct fields, including text_ptr and term_spec, allowing for the corruption of live pointers. This can be exploited to achieve arbitrary write and arbitrary free primitives within the BEAM VM. The vulnerability is reachable pre-authentication over the network if the Megaco stack is configured with the {scanner, flex} option. Patches are available in OTP versions 29.0.4, 28.5.0.4, and 27.3.4.15.

## Affected products

- Erlang OTP 17.0 to 27.3.4.14, 28.0 to 28.5.0.3, 29.0 to 29.0.3
- Erlang megaco 3.17.1 to 4.7.2.1, 4.8.0 to 4.8.3.0, 4.9.0

## Timeline

- 2026-07-27: advisory
- 2026-07-27: disclosed

## References

- [https://github.com/](https://github.com/)
- [https://cna.erlef.org/cves/CVE-2026-59250.html](https://cna.erlef.org/cves/CVE-2026-59250.html)
- [https://github.com/erlang/otp/commit/8704c8f550a11ed5f825e3c011ecb03565b79c4f](https://github.com/erlang/otp/commit/8704c8f550a11ed5f825e3c011ecb03565b79c4f)
- [https://github.com/erlang/otp/security/advisories/GHSA-7xgh-gmgf-q2g7](https://github.com/erlang/otp/security/advisories/GHSA-7xgh-gmgf-q2g7)
- [https://www.erlang.org/doc/system/versions.html](https://www.erlang.org/doc/system/versions.html)

## Related threats

- [Erlang OTP erl_tar infinite loop in GNU sparse member handling](https://junglewise.ai/threats/cve-2026-96596-loop-with-unreachable-exit-condition-infinite-loop-vulnerability)
- [Erlang OTP ssl denial of service in TLS 1.3 NewSessionTicket](https://junglewise.ai/threats/cve-2026-94200-improper-validation-of-consistency-within-input-vulnerability-in)
- [Erlang/OTP ssl TLS 1.3 server authentication bypass](https://junglewise.ai/threats/cve-2026-89422-key-exchange-without-entity-authentication-vulnerability-in)
- [Erlang/OTP SSH unbounded session channel allocation denial of service](https://junglewise.ai/threats/cve-2026-68956-allocation-of-resources-without-limits-or-throttling)
- [Erlang OTP asn1 OBJECT IDENTIFIER decoder algorithmic complexity denial of service](https://junglewise.ai/threats/cve-2026-65634-inefficient-algorithmic-complexity-in-the-erlang-otp-asn1-object)