CVE-2016-10253

CRITICAL

Erlang/OTP 18.x - Heap Overflow via Malformed Regular Expression Extpattern

Title source: llm
STIX 2.1

Description

An issue was discovered in Erlang/OTP 18.x. Erlang's generation of compiled regular expressions is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset that is used as an array index. This ordinal permits arbitrary regions within the erts_alloc arena to be both read and written to.

References (2)

Core 2
Core References
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3571-1/
Third Party Advisory x_refsource_misc
https://github.com/erlang/otp/pull/1108

Scores

CVSS v3 9.8
EPSS 0.0148
EPSS Percentile 70.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-119
Status published
Products (46)
erlang/erlang\/otp 18.0 (3 CPE variants)
erlang/erlang\/otp 18.0.1
erlang/erlang\/otp 18.0.2
erlang/erlang\/otp 18.0.3
erlang/erlang\/otp 18.1
erlang/erlang\/otp 18.1.1
erlang/erlang\/otp 18.1.2
erlang/erlang\/otp 18.1.3
erlang/erlang\/otp 18.1.4
erlang/erlang\/otp 18.1.5
... and 36 more
Published Mar 18, 2017
Tracked Since Feb 18, 2026