CVE-2026-49759: Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash

Synopsis

A stack-based buffer overflow exists in the SCTP error cause parsing code inside Erlang/OTP's inet_drv driver (erts). The vulnerability is reachable over the network by any unauthenticated attacker who can establish an SCTP association to a listening port, requiring no authentication and no victim interaction. Successful exploitation crashes the BEAM VM, causing a denial of service; a secondary side effect can leak small fragments of VM memory into the error packet visible to the receiving Erlang process. Patched-image rebuilds at the fix commits are available on HarborGuard for environments running an affected OTP version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target over the network and establish a valid SCTP association to a port where the Erlang application is listening.

• AuthenticationNot required

  No credentials or session token are needed; the malicious SCTP ERROR chunk can be sent by any unauthenticated peer that completes the SCTP handshake.

• Victim interactionNot required

  No user action is required; the overflow is triggered entirely by the attacker sending a crafted packet to the listening service.

• Attack complexityDetail

  Exploitation is reliable and condition-free once an SCTP association exists; no race conditions, memory-layout dependencies, or special environmental factors are required.

Blast Radius

• Crashes the BEAM VM process, taking down all Erlang application logic running on that node until it is restarted.
• Leaks fragments of Erlang VM stack memory into the error cause data visible to the receiving Erlang process, exposing whatever happened to occupy adjacent stack space at the time of the overflow.
• Because return-address control is not achievable (only 16-bit values interleaved with a fixed tag can be written), arbitrary code execution is not possible with this overflow; impact is limited to denial of service and the narrow memory disclosure described above.