CyberSecBulletin
CVE-2026-55737NVD status: Modified

OTP: Signed to Unsigned Conversion Error

Published Updated By the CyberSecBulletin desk

CVE-2026-55737 is a high-severity signed to unsigned conversion error vulnerability in OTP from Erlang, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists version c5210b42a9d3d96f3d25601942ce8122be0f3761 as the first without the flaw, so updating OTP to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.31% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update OTP to c5210b42a9d3d96f3d25601942ce8122be0f3761 or a later version.
  2. Update Erlang/otp to 27.3.4.15 or 28.5.0.4 or 29.0.4, whichever matches your release line, or a later version.
  3. Update Erts to 15.2.7.11 or 16.4.0.4 or 17.0.4, whichever matches your release line, or a later version.
  4. Read the advisory on github.com for workarounds and exact fixed builds.
  5. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
ErlangOTP25.0 and later; 13.0 and later; ebcbb97b4ec223464cac3d94375739a248ddef6e up to, but not including, c5210b42a9d3d96f3d25601942ce8122be0f3761c5210b42a9d3d96f3d25601942ce8122be0f3761
ErlangErlang/otp25.0 up to, but not including, 27.3.4.15; 28.0 up to, but not including, 28.5.0.4; 29.0 up to, but not including, 29.0.427.3.4.15, 28.5.0.4, 29.0.4
ErlangErts13.0 up to, but not including, 15.2.7.11; 16.0 up to, but not including, 16.4.0.4; 17.0 up to, but not including, 17.0.415.2.7.11, 16.4.0.4, 17.0.4

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
NoneNo data is disclosed.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 4.05.1MediumCNA
CVSS 3.17.5HighNVD

Official description

Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format (ETF) binary to binary_to_term/1 to corrupt the BEAM heap pointer and crash the virtual machine. When decoding a LARGE_TUPLE_EXT term, the validation pass decoded_size() in erts/emulator/beam/external.c reads the 32-bit arity field as unsigned (get_uint32()), while the decode pass dec_term() reads the same field as a signed 32-bit integer (get_int32()) into an int. An arity wire value of 0x80000000 passes validation as 2147483648 but decodes as -2147483648, so the subsequent hp += n moves the heap allocation pointer backward. Neither pass enforces the runtime tuple-arity limit MAX_ARITYVAL. The result is an out-of-bounds heap write; in practice the VM detects an impossible heap size and aborts, denying service. The required padding is large when uncompressed but the compressed-ETF envelope shrinks it to a small payload on the wire. This issue affects OTP from OTP 25.0 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to erts from 13.0 before 15.2.7.11, 16.4.0.4, and 17.0.4.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Signed to Unsigned Conversion Error

The product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.

More Signed to Unsigned Conversion Error vulnerabilities (CWE-195)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in OTP

All OTP vulnerabilities

Recent Signed to Unsigned Conversion Error vulnerabilities

Spotted an error? Tell us.