Elixir CVE-2026-75758

The attacker must control the content of a list that reaches inspect/1, List.to_string/1, or List.to_charlist/1 within a running Elixir application. The crafted list must contain more than 4096 consecutive elements that are valid ASCII code points (the default :printable_limit), followed by at least one element that is not a valid Unicode code point - specifically an atom, nil, an integer outside the range 0-0xD7FF or 0xE000-0x10FFFF, or an improper list tail. Lists whose invalid element appears within the first 4096 positions do not trigger the recursive loop because the inner inspect/1 call then classifies the full list in ordinary bracket form and raises a single non-recursive ArgumentError. The CVSS AT:P metric confirms this specific structural precondition. Applications that do not expose user-controlled data to these standard library functions are not affected regardless of Elixir version.

The provided CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:N/VA:H) assigns a local attack vector, reflecting that exploitation requires the ability to pass a controlled list directly into the affected standard library functions. In practice, Phoenix web applications and other network-facing Elixir services frequently call inspect/1 or List.to_string/1 on user-supplied data, which could allow a remote attacker to reach this code path through an application endpoint - this discrepancy between the local vector and real-world deployment patterns should be verified against each application's data flow before dismissing network risk. AT:P correctly captures the specific structural precondition: the list must have more than printable_limit valid code points before the invalid element. No EPSS score was included in the provided intelligence, and the vulnerability does not appear in the CISA KEV catalogue, indicating no confirmed widespread exploitation at time of analysis. The availability impact is high - successful exploitation crashes the targeted process and, without max_heap_size configured, the entire BEAM node - while confidentiality and integrity are unaffected. The 'Information Disclosure' tag present in the source metadata is inconsistent with both the CVSS vector and the technical mechanism; no data exposure pathway is evident, and this tag should be treated as a mis-labelling. No public proof-of-concept code has been identified at time of analysis, though the attack is easily reconstructed from the public description and patch diff.

An attacker submits a crafted payload to a Phoenix web API endpoint that internally calls List.to_string/1 or inspect/1 on user-provided binary-decoded list data - for example, a list of 4097 valid ASCII byte values (e.g., List.duplicate(?a, 4097) ++ [nil]) - causing IO.chardata_to_string/1 to raise ArgumentError, whose rescue clause recursively re-invokes inspect/1 on the same list, retaining all stack frames until the BEAM process heap is exhausted and the node becomes unresponsive or crashes. No public proof-of-concept code has been identified at time of analysis, though the attack vector is straightforwardly reconstructable from the public advisory and the patch diff committed to the Elixir repository.