Erlang/OTP -- binary_to_term crash on crafted BIT_BINARY_EXT input

2026-07-27 · CVE-2026-54890 · VuXML entry

https://github.com/erlang/otp/security/advisories/GHSA-54pw-5645-jh86 reports: A specially crafted External Term Format (ETF) payload of merely 7 bytes triggers a crash in the BEAM virtual machine when processed by binary_to_term/1,2. The BIT_BINARY_EXT tag with specific parameters causes an unsigned integer underflow during bitstring size calculation, resulting in an enormous memory allocation attempt that …

Affected versions

• erlang >= 27.0,4 < 28.5.0.4,4
• erlang-runtime27 < 27.3.4.15
• erlang-runtime28 < 28.5.0.4
• erlang-runtime29 < 29.0.4

By system

2 still vulnerable, 5 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.