FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Erlang/OTP -- binary_to_term crash on crafted BIT_BINARY_EXT input

Affected packages
27.0,4 <= erlang < 28.5.0.4,4
erlang-runtime27 < 27.3.4.15
erlang-runtime28 < 28.5.0.4
erlang-runtime29 < 29.0.4

Details

VuXML ID 445dc6b9-89e1-11f1-b35c-4c526214c986
Discovery 2026-07-27
Entry 2026-07-27

https://github.com/erlang/otp/security/advisories/GHSA-54pw-5645-jh86 reports:

A specially crafted External Term Format (ETF) payload of merely 7 bytes triggers a crash in the BEAM virtual machine when processed by binary_to_term/1,2. The BIT_BINARY_EXT tag with specific parameters causes an unsigned integer underflow during bitstring size calculation, resulting in an enormous memory allocation attempt that immediately terminates the VM. This is a full system crash, not a recoverable process exception: Erlang supervision mechanisms, the [safe] option and standard error handling cannot prevent it.

References

CVE Name CVE-2026-54890
URL https://github.com/erlang/otp/security/advisories/GHSA-54pw-5645-jh86