Erlang/OTP SCTP Parsing Flaw Lets Remote Attackers Crash the BEAM VM

Erlang/OTP disclosed CVE-2026-49759, a high-severity stack buffer overflow in the inet_drv SCTP error-cause parsing path that can let an unauthenticated remote attacker crash the BEAM VM. The flaw is in sctp_parse_error_chunk in erts/emulator/drivers/common/inet_drv.c, where crafted SCTP ERROR chunks can overflow a fixed-size stack buffer while cause codes are converted into ErlDrvTermData entries. Exploitation requires SCTP support to be enabled, a listening SCTP socket to be exposed through gen_sctp using the default inet backend, and network reachability to that port; Windows builds are not affected because SCTP is unsupported there.

Advisories and the upstream patch indicate the issue is primarily denial of service, not expected remote code execution, because stack protections should terminate the process before meaningful control of execution is possible and the overwrite pattern is constrained. A crafted packet may also leak limited Erlang VM memory in an error response. The vulnerability affects OTP releases from 17.0 up to but excluding 27.3.4.13, 28.5.0.2, and 29.0.2. The fix adds bounds checking and truncation safeguards in SCTP parsing and related async-event handling to prevent output term buffer overruns during malformed packet processing.