Erlang/OTP CVE-2026-54890

Exploitation requires that the target application decode Erlang External Term Format from an untrusted source via binary_to_term/1,2 or enif_binary_to_term() - this is the concrete gate (reflected as AT:P in the vendor vector). The [safe] option to binary_to_term/2 does NOT mitigate it, since [safe] only restricts atom creation and performs no structural validation of binary encodings. The Erlang distribution protocol traverses the same decoder, but per OTP Secure Coding Guideline DSG-011 distribution is expected to run only on trusted networks, so distribution-only exposure is not a realistic attack surface. Affected: OTP 27.0 up to (not including) 29.0.4, plus 28.5.0.4 and 27.3.4.15 (erts 15.0 up to 17.0.4, and 16.4.0.4 / 15.2.7.11). The limiting factor is application design: nodes that never pass untrusted bytes to term decoding are not exposed regardless of version.

This is a genuine but bounded availability risk, not a top-tier emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) with VA:H and VC:N/VI:N correctly scopes this as an availability-only, network-reachable, unauthenticated flaw whose only impact is a full VM abort of the Erlang node - there is no code execution or data disclosure despite the 'Forced Integer Overflow' framing. The AT:P (attack requirements present) metric is the pivotal honest signal: exploitation is not universal against a default install but requires an application that feeds attacker-controlled bytes into binary_to_term/1,2 or enif_binary_to_term(). All exploitation-maturity signals point away from urgency: EPSS is 0.32% (24th percentile), there is no CISA KEV listing, no public exploit code is referenced, and CISA SSVC records Exploitation:none / Automatable:no / Technical Impact:partial. These are internally consistent - a low-EPSS, non-KEV, non-automatable finding with partial technical impact. The severity driver is the un-catchable nature of the crash (it bypasses supervision trees, try/catch, and the [safe] option), which turns a single crafted term into an unrecoverable node kill for exposed services. Net: treat as a standard-priority patch for any service that decodes untrusted ETF; deprioritize for nodes that only decode ETF over trusted distribution links.

An attacker identifies a service that deserializes external input with binary_to_term (e.g. a message queue, cache, session token, or custom protocol endpoint that accepts ETF), and sends the 7-byte crafted BIT_BINARY_EXT term <<131,77,0,0,0,0,0>> with both length and trailing-bits set to zero. The size computation underflows to ~2^64, the allocator refuses the impossible allocation, and the entire BEAM VM aborts - killing all processes on the node in one shot, uncatchable by supervision. No public exploit code is identified at time of analysis, but the trigger is trivially small and fully documented in the fix's test case.