Skip to content
Fencer Vulns
high 8.3

CVE-2026-59250 json

Megaco flex scanner buffer overflow via oversized property parm name

published 2026-07-27 3 mo ago modified 2026-10-24 16 d ago also EUVD-2026-49324

cvss
8.3
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 56%
public exploits
0
none known

Summary

Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (and potentially achieve remote code execution or a denial-of-service crash) by sending a single text-encoded H.248/Megaco message containing an oversized property parm name.

When tokenizing a Local/Remote descriptor, mfs_load_property_groups extracts the attacker-controlled property name (bounded only by the message length) and, when no value follows, formats it into a fixed 512-byte error_msg field of the MfsErlDrvData struct using an unchecked sprintf call. Names longer than roughly 452 bytes overflow into the immediately following struct fields (text_buf, text_ptr, term_spec, term_spec_size, term_spec_index), overwriting live pointers and counters with attacker-chosen bytes. Subsequent scanner code writes and frees through the corrupted pointers, producing arbitrary write and arbitrary free primitives inside the BEAM VM process, which can be leveraged for remote code execution. On builds compiled with _FORTIFY_SOURCE the overflow is detected at runtime and terminates the process with SIGABRT, resulting in denial of service.

The overflow occurs in the flex scanner before any grammar or Megaco-level authentication processing, so exploitation requires only network reachability to the megaco transport port on a node configured with {scanner, flex}.

This vulnerability is associated with program files lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src and program routines mfs_load_property_groups.

This issue affects OTP from OTP 17.0 before OTP 27.3.4.15, from OTP 28.0 before OTP 28.5.0.4, and from OTP 29.0 before OTP 29.0.4, corresponding to megaco from 3.17.1 before 4.7.2.2, from 4.8 before 4.8.3.1, and from 4.9 before 4.9.1. Whether OTP before OTP 17.0, corresponding to megaco before 3.17.1, is affected is unknown.

Patch / fix

  • Erlang OTP 4.7.2.2, 4.8.3.1, 4.9.1, 27.3.4.15, 28.5.0.4, 29.0.4
  • erlang Debian 13 1:27.3.4.1+dfsg-1+deb13u3
  • erlang Debian 14 1:29.0.4+dfsg-1

debian advisories DEBIAN-CVE-2026-59250

  • erlang Ubuntu 22.04 LTS 1:24.2.1+dfsg-1ubuntu0.7
  • erlang Ubuntu 24.04 LTS 1:25.3.2.8+dfsg-1ubuntu4.7
  • erlang Ubuntu 26.04 LTS 1:27.3.4.6+dfsg-1ubuntu0.1
  • erlang Ubuntu Pro 14.04 LTS 1:16.b.3-dfsg-1ubuntu2.2+esm2
  • erlang Ubuntu Pro 16.04 LTS 1:18.3-dfsg-1ubuntu3.1+esm3
  • erlang Ubuntu Pro 18.04 LTS 1:20.2.2+dfsg-1ubuntu2+esm3
  • erlang Ubuntu Pro 20.04 LTS 1:22.2.7+dfsg-1ubuntu0.5+esm2

ubuntu advisories UBUNTU-CVE-2026-59250

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • erlang27 hummingbird 1 27.3.4.15-0.1.hum1
  • erlang27-et hummingbird 1 27.3.4.15-0.1.hum1
  • erlang27-wx hummingbird 1 27.3.4.15-0.1.hum1
  • erlang27-ftp hummingbird 1 27.3.4.15-0.1.hum1
  • erlang27-ssh hummingbird 1 27.3.4.15-0.1.hum1
  • erlang27-ssl hummingbird 1 27.3.4.15-0.1.hum1
  • erlang27-asn1 hummingbird 1 27.3.4.15-0.1.hum1
  • erlang27-edoc hummingbird 1 27.3.4.15-0.1.hum1

red hat advisories RHSA-2026:47009

  • erlang SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 23.3.4.19-150300.3.39.1
  • erlang26 SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Server Applications 15 SP7 26.2.1-150300.7.28.1

suse advisories SUSE-SU-2026:3645-1SUSE-SU-2026:3579-1

  • erlang openSUSE Tumbleweed 28.5.0.4-1.1
  • erlang27 openSUSE Tumbleweed 27.1.3-3.1

opensuse advisories openSUSE-SU-2026:11559-1openSUSE-SU-2026:11560-1

  • erlang Azure Linux 3.0 26.2.5.21-6

azure linux advisories AZL-95666

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-59250 updated cvss 8.2

megaco: Erlang/OTP Megaco Flex Scanner: Remote code execution or denial of service via oversized message

  • Red Hat Hardened Images erlang27 27.3.4.15-0.1.hum1
    fixed: vendor fix RHSA-2026:47009

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.78% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
CNA 4.0 8.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Erlang OTP

Classification

Weakness
  • CWE-120 Buffer Copy without Checking Size of Input
  • CWE-787 Out-of-bounds Write

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.