CVE-2026-55737
Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder
Description
Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format (ETF) binary to binary_to_term/1 to corrupt the BEAM heap pointer and crash the virtual machine. When decoding a LARGE_TUPLE_EXT term, the validation pass decoded_size() in erts/emulator/beam/external.c reads the 32-bit arity field as unsigned (get_uint32()), while the decode pass dec_term() reads the same field as a signed 32-bit integer (get_int32()) into an int. An arity wire value of 0x80000000 passes validation as 2147483648 but decodes as -2147483648, so the subsequent hp += n moves the heap allocation pointer backward. Neither pass enforces the runtime tuple-arity limit MAX_ARITYVAL. The result is an out-of-bounds heap write; in practice the VM detects an impossible heap size and aborts, denying service. The required padding is large when uncompressed but the compressed-ETF envelope shrinks it to a small payload on the wire. This issue affects OTP from OTP 25.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 13.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.
INFO
Published Date :
July 27, 2026, 4:17 p.m.
Last Modified :
July 27, 2026, 4:17 p.m.
Remotely Exploit :
No
Source :
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 4.0 | MEDIUM | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | ||||
| CVSS 4.0 | MEDIUM | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db |
Solution
- Update Erlang OTP to version 27.3.4.15 or later.
- Update Erlang OTP to version 28.5.0.4 or later.
- Update Erlang OTP to version 29.0.4 or later.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-55737.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-55737 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-55737
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-55737 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-55737 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Jul. 27, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/erlang/otp', 'vendor': 'Erlang', 'modules': ['erlang', 'external'], 'product': 'OTP', 'versions': [{'status': 'affected', 'changes': [{'at': '17.0.4', 'status': 'unaffected'}, {'at': '16.4.0.4', 'status': 'unaffected'}, {'at': '15.2.7.11', 'status': 'unaffected'}], 'version': '13.0', 'lessThan': '*', 'versionType': 'otp'}], 'packageURL': 'pkg:otp/erts?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git', 'packageName': 'erts', 'programFiles': ['emulator/beam/external.c'], 'defaultStatus': 'unaffected', 'programRoutines': [{'name': 'erlang:binary_to_term/1'}, {'name': 'erlang:binary_to_term/2'}, {'name': 'dec_term'}, {'name': 'decoded_size'}]}, {'cpes': ['cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/erlang/otp', 'vendor': 'Erlang', 'modules': ['erlang', 'external'], 'product': 'OTP', 'versions': [{'status': 'affected', 'changes': [{'at': '29.0.4', 'status': 'unaffected'}, {'at': '28.5.0.4', 'status': 'unaffected'}, {'at': '27.3.4.15', 'status': 'unaffected'}], 'version': '25.0', 'lessThan': '*', 'versionType': 'otp'}, {'status': 'affected', 'version': 'ebcbb97b4ec223464cac3d94375739a248ddef6e', 'lessThan': 'c5210b42a9d3d96f3d25601942ce8122be0f3761', 'versionType': 'git'}], 'packageURL': 'pkg:github/erlang/otp', 'packageName': 'erlang/otp', 'programFiles': ['erts/emulator/beam/external.c'], 'collectionURL': 'https://github.com', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': 'erlang:binary_to_term/1'}, {'name': 'erlang:binary_to_term/2'}, {'name': 'dec_term'}, {'name': 'decoded_size'}]}] Added Description Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format (ETF) binary to binary_to_term/1 to corrupt the BEAM heap pointer and crash the virtual machine. When decoding a LARGE_TUPLE_EXT term, the validation pass decoded_size() in erts/emulator/beam/external.c reads the 32-bit arity field as unsigned (get_uint32()), while the decode pass dec_term() reads the same field as a signed 32-bit integer (get_int32()) into an int. An arity wire value of 0x80000000 passes validation as 2147483648 but decodes as -2147483648, so the subsequent hp += n moves the heap allocation pointer backward. Neither pass enforces the runtime tuple-arity limit MAX_ARITYVAL. The result is an out-of-bounds heap write; in practice the VM detects an impossible heap size and aborts, denying service. The required padding is large when uncompressed but the compressed-ETF envelope shrinks it to a small payload on the wire. This issue affects OTP from OTP 25.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 13.0 before 17.0.4, 16.4.0.4 and 15.2.7.11. Added CVSS V4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-787 Added CWE CWE-195 Added Reference https://cna.erlef.org/cves/CVE-2026-55737.html Added Reference https://github.com/erlang/otp/commit/c5210b42a9d3d96f3d25601942ce8122be0f3761 Added Reference https://github.com/erlang/otp/security/advisories/GHSA-446w-268v-9462 Added Reference https://osv.dev/vulnerability/EEF-CVE-2026-55737 Added Reference https://www.erlang.org/doc/system/versions.html#order-of-versions