CVE-2016-10253

Critical

Published: 18/03/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

An issue was discovered in Erlang/OTP 18.x related to the generation of compiled regular expressions, which is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset used as an array index.

Risk Assessment

This vulnerability allows arbitrary regions within the erts_alloc arena to be both read and written to, potentially leading to serious security breaches in the system.

Recommendation

It is recommended to upgrade to the latest version of Erlang/OTP to mitigate this vulnerability and to monitor applications using regular expressions for potential abuse.

Original NVD description (English source)

An issue was discovered in Erlang/OTP 18.x. Erlang's generation of compiled regular expressions is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset that is used as an array index. This ordinal permits arbitrary regions within the erts_alloc arena to be both read and written to.