# CVE-2026-54890: BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding

> Attackers can crash the Erlang VM by sending crafted binary data, causing a denial of service in applications decoding untrusted terms.

- **Severity:** High 8.2 (`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 27 Jul 2026
- **Updated:** 28 Jul 2026
- **Also known as:** DEBIAN-CVE-2026-54890, EEF-CVE-2026-54890, GHSA-54pw-5645-jh86, UBUNTU-CVE-2026-54890

## What is CVE-2026-54890?

CVE-2026-54890 is a high-severity vulnerability in Erlang OTP, published on 27 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c.

The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflows an unsigned integer, producing a value of roughly 2^64 that is then passed as a memory allocation size. The allocator aborts the entire node with a message such as "Cannot allocate 2305843009213693951 bytes of memory (of type binary)".

The crash is a VM-level abort, not an Erlang-level exception. It cannot be intercepted by supervision trees, by try/catch, or by passing the [safe] option to binary_to_term/2 (which only restricts atom creation and does not perform structural validation of binary encodings).

Any application that decodes ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also decodes incoming terms through the same code path, but distribution is expected to run on trusted networks per the OTP Secure Coding Guidelines (DSG-011).

This issue affects OTP from OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts from 15.0 before 17.0.4, 16.4.0.4 and 15.2.7.11.

Weakness: CWE-789 (Memory Allocation with Excessive Size Value), CWE-191 (Integer Underflow (Wrap or Wraparound)), CWE-1284 (Improper Validation of Specified Quantity in Input)

## Which versions are affected by CVE-2026-54890?

It affects 2 products.


Products: Erlang Erlang\/Otp, Erlang Erts.

## How do I fix CVE-2026-54890?

Upgrade to a fixed version.

## Is CVE-2026-54890 being exploited?

There is no known exploitation of CVE-2026-54890 in the wild and no public exploit code.

## Other vulnerabilities in Erlang OTP

- [CVE-2022-37026](https://insights.sbomify.com/CVE-2022-37026/): Auth bypass in n/a (critical 9.8)
- [CVE-2016-10253](https://insights.sbomify.com/CVE-2016-10253/): Memory corruption in n/a (critical 9.8)
- [CVE-2026-55953](https://insights.sbomify.com/CVE-2026-55953/): TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication (critical 9.1)
- [CVE-2026-49759](https://insights.sbomify.com/CVE-2026-49759/): Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash (high 8.8)
- [CVE-2026-58227](https://insights.sbomify.com/CVE-2026-58227/): TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain (high 8.7)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-54890 and fix it if it is affected.

What it is: CVE-2026-54890 is a high-severity vulnerability in Erlang OTP, published on 27 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-54890 in the wild and no public exploit code.

Affected product: Erlang OTP. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-54890/ (Markdown: https://insights.sbomify.com/CVE-2026-54890/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-54890
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-54890
- OSV: https://osv.dev/vulnerability/CVE-2026-54890

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-54890/
Summaries are generated and may contain mistakes; the official description above is the record.