Megaco flex scanner buffer overflow via oversized property parm name (CVE-2026-59250)

What is affected, what to do

Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (and potentially achieve remote code execution or a denial-of-service crash) by sending a single text-encoded H.248/Megaco message containing an oversized property parm name. When tokenizing a Local/Remote descriptor, mfs_load_property_groups extracts the attacker-controlled property name (bounded only by the message length) and, when no value follows, formats it into a fixed 512-byte error_msg field of the MfsErlDrvData struct using an unchecked sprintf call.

Update Erlang OTP to version 27.3.4.15, Erlang OTP to version 28.5.0.4, Erlang OTP to version 29.0.4.

Affected

• Erlang OTP lt 17.0..27.3.4.15
• Erlang OTP lt 28.0..28.5.0.4
• Erlang OTP lt 29.0..29.0.4
• Erlang OTP lt 3.17.1..4.7.2.2
• Erlang OTP lt 4.8..4.8.3.1
• Erlang OTP lt 4.9..4.9.1

Fixed in

• Erlang OTP 27.3.4.15
• Erlang OTP 28.5.0.4
• Erlang OTP 29.0.4
• Erlang OTP 4.7.2.2
• Erlang OTP 4.8.3.1
• Erlang OTP 4.9.1

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

High technical severity: assess and remediate the vulnerability in vulnerability handling under Art. 21(2)(e) NIS2 and document the decision.

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (and potentially achieve remote code execution or a denial-of-service crash) by sending a single text-encoded H.248/Megaco message containing an oversized property parm name. When tokenizing a Local/Remote descriptor, mfs_load_property_groups extracts the attacker-controlled property name (bounded only by the message length) and, when no value follows, formats it into a fixed 512-byte error_msg field of the MfsErlDrvData struct using an unchecked sprintf call. Names longer than roughly 452 bytes overflow into the immediately following struct fields (text_buf, text_ptr, term_spec, term_spec_size, term_spec_index), overwriting live pointers and counters with attacker-chosen bytes. Subsequent scanner code writes and frees through the corrupted pointers, producing arbitrary write and arbitrary free primitives inside the BEAM VM process, which can be leveraged for remote code execution. On builds compiled with _FORTIFY_SOURCE the overflow is detected at runtime and terminates the process with SIGABRT, resulting in denial of service. The overflow occurs in the flex scanner before any grammar or Megaco-level authentication processing, so exploitation requires only network reachability to the megaco transport port on a node configured with {scanner, flex}. This vulnerability is associated with program files lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src and program routines mfs_load_property_groups. This issue affects OTP from OTP 17.0 before OTP 27.3.4.15, from OTP 28.0 before OTP 28.5.0.4, and from OTP 29.0 before OTP 29.0.4, corresponding to megaco from 3.17.1 before 4.7.2.2, from 4.8 before 4.8.3.1, and from 4.9 before 4.9.1. Whether OTP before OTP 17.0, corresponding to megaco before 3.17.1, is affected is unknown.

Source: Ubuntu Security Notices, NVD (NIST), suse_csaf, Microsoft Security Update Guide, OSV (Open Source Vulnerabilities), cvelistv5, redhat_csaf, Debian Security Advisories, CVE.org (MITRE), BSI WID Portal, BSI CSAF

Vendors and products

• Debian Erlang
• Erlang Erlang OTP
• Open Source Erlang/otp
• Ubuntu Erlang

Weakness classes (CWE)

• CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  Base

  The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

  Entry at MITRE CWE-120

• CWE-787Out-of-bounds Write

  Base

  The product writes data past the end, or before the beginning, of the intended buffer.

  Entry at MITRE CWE-787

References & sources

• github.comerlang/otp/security/advisories/GHSA-7xgh-gmgf-q2g7advisory, Vendor advisory, related
• cna.erlef.orgcves/CVE-2026-59250.htmlweb, related
• erlang.orgdoc/system/versions.htmlweb, x_version-scheme
• github.comerlang/otp/commit/8704c8f550a11ed5f825e3c011ecb03565b79c4ffix, Patch
• OSV (Open Source Vulnerabilities)vulnerability/EEF-CVE-2026-59250related

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 08.09.2026Record modifiedEEF

   1 individual change: Affected versions (publisher)

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Affected versions (publisher)	added	—	Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/59xxx/CVE-2026-59250.json">CVE-2026-59250</a>

   Source identifier: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db

2. 27.07.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: none known, automatable: no

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	added	—	{"id":"CVE-2026-59250","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"version":"2.0.3","timestamp":"2026-07-27T18:33:04.735708Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

3. 27.07.2026ReceivedEEF

   CVSS V4.0: AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

   Weakness type: CWE-787, CWE-120

   Description added or changed

   New references:

   • https://cna.erlef.org/cves/CVE-2026-59250.html
   • https://github.com/erlang/otp/commit/8704c8f550a11ed5f825e3c011ecb03565b79c4f
   • https://github.com/erlang/otp/security/advisories/GHSA-7xgh-gmgf-q2g7
   • https://osv.dev/vulnerability/EEF-CVE-2026-59250

   and 1 more reference

   Show 10 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Affected versions (publisher)	added	—	OTP, OTP
   Description	added	—	Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (and potentially achieve remote code execution or a denial-of-service crash) by sending a single text-encoded H.248/Megaco message containing an oversized property parm name. When tokenizing a Local/Remote descriptor, mfs_load_property_groups extracts the attacker-controlled property name (bounded only by the message length) and, when no value follows, formats it into a fixed 512-byte error_msg field of the MfsErlDrvData struct using an unchecked sprintf call. Names longer than roughly 452 bytes overflow into the immediately following struct fields (text_buf, text_ptr, term_spec, term_spec_size, term_spec_index), overwriting live pointers and counters with attacker-chosen bytes. Subsequent scanner code writes and frees through the corrupted pointers, producing arbitrary write and arbitrary free primitives inside the BEAM VM process, which can be leveraged for remote code execution. On builds compiled with _FORTIFY_SOURCE the overflow is detected at runtime and terminates the process with SIGABRT, resulting in denial of service. The overflow occurs in the flex scanner before any grammar or Megaco-level authentication processing, so exploitation requires only network reachability to the megaco transport port on a node configured with {scanner, flex}. This vulnerability is associated with program files lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src and program routines mfs_load_property_groups. This issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to megaco from 3.17.1 before 4.9.1, 4.8.3.1 and 4.7.2.2. Versions prior to OTP 17.0 are also affected but are not listed because the OTP version scheme is only defined from OTP 17.0 onwards.
   CVSS	added	—	AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
   Weakness type (CWE)	added	—	CWE-787
   Weakness type (CWE)	added	—	CWE-120
   Reference	added	—	https://cna.erlef.org/cves/CVE-2026-59250.html
   Reference	added	—	https://github.com/erlang/otp/commit/8704c8f550a11ed5f825e3c011ecb03565b79c4f
   Reference	added	—	https://github.com/erlang/otp/security/advisories/GHSA-7xgh-gmgf-q2g7
   Reference	added	—	https://osv.dev/vulnerability/EEF-CVE-2026-59250
   Reference	added	—	https://www.erlang.org/doc/system/versions.html#order-of-versions

   Source identifier: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db

One NVD translation into another language is hidden.