Quick answers
- Is CVE-2026-75538 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-75538 being exploited in the wild.
- How severe is CVE-2026-75538?
- Informational severity, with a CVSS score of 8.2, published 1 September 2026.
- Which products and versions are affected?
- Erlang OTP 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6.
- Is there a fix for CVE-2026-75538?
- A patch was published on 2026-09-01: Fixes released in OTP 27.3.4.17, 28.5.0.6, and 29.0.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-75538 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-75538?
- Check whether you run Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A signed integer overflow in the inet driver's packet length calculation when using {packet,4} mode allows an attacker to overwrite the receive buffer beyond its allocated bounds. The vulnerability stems from incorrect validation of the packet length field, permitting values that wrap around due to signed integer arithmetic. An unauthenticated attacker with network access to an open Erlang TCP port can exploit this with a single malicious connection. The overflow corrupts the BEAM VM's memory allocator metadata and adjacent heap blocks, reliably causing a denial of service (crash). Remote code execution is considered infeasible due to the difficulty of achieving sufficient precision over the corrupted memory layout.
Affected products
- Erlang OTP 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6
Timeline
- 2026-09-01: disclosed
- 2026-09-01: patched: Fixes released in OTP 27.3.4.17, 28.5.0.6, and 29.0.6