Erlang/OTP EUVD-2026-69242

Exploitation requires that the target Erlang TCP port be network-reachable from the attacker and explicitly configured to use {packet,4} framing - a developer-specified opt-in mode, not a universal default for all Erlang TCP sockets. No authentication is required (PR:N per the CVSS 4.0 vector); exploitation consists of sending a single crafted packet. Exploitation is limited to availability impact (VM crash); the vendor advisory explicitly states remote code execution is 'extremely unfeasible' due to imprecision of heap corruption at the scale triggered. Applications using other framing modes ({packet,0}, {packet,1}, {packet,2}, or raw) are not affected. OTP versions before 17.0 have unknown exposure status per the vendor advisory.

The CVSS 4.0 score of 8.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VA:H) accurately reflects a remotely triggerable, unauthenticated denial-of-service with no confidentiality or integrity impact. AT:P correctly captures the prerequisite that the targeted service must be configured for {packet,4} framing, which reduces universality of exposure compared to a fully default-exploitable flaw - the attacker must first identify a service using this specific mode. The primary real-world risk is service availability: crashing the BEAM VM terminates all Erlang processes in that instance, which is severe for long-running telecommunications switches, message brokers (e.g., RabbitMQ), ejabberd deployments, or distributed systems workloads that depend on continuous uptime. No CISA KEV listing and no confirmed public exploit code reduce opportunistic mass-exploitation probability, though targeted attacks against known Erlang service endpoints remain plausible once the flaw is understood by threat actors. The 'RCE' tag in the input metadata conflicts directly with the vendor's own advisory text, which explicitly states RCE is 'extremely unfeasible'; this tag should be treated as mislabeled.

An attacker who can reach an exposed Erlang TCP service configured with {packet,4} framing establishes a connection and sends a single malformed message with a packet length field set to a value near INT_MAX. The signed integer overflow in packet_get_length causes the runtime to attempt a multi-gigabyte buffer allocation, corrupting VM allocator metadata and adjacent heap structures; the BEAM VM crashes immediately, terminating all Erlang processes in that instance. No authentication or prior session state is required, and no public exploit code has been confirmed.