Remotely reachableNo privilegesZero-click3 weeks old
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · unedited
Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (and potentially achieve remote code execution or a denial-of-service crash) by sending a single text-encoded H.248/Megaco message containing an oversized property parm name.
When tokenizing a Local/Remote descriptor, mfs_load_property_groups extracts the attacker-controlled property name (bounded only by the message length) and, when no value follows, formats it into a fixed 512-byte error_msg field of the MfsErlDrvData struct using an unchecked sprintf call. Names longer than roughly 452 bytes overflow into the immediately following struct fields (text_buf, text_ptr, term_spec, term_spec_size, term_spec_index), overwriting live pointers and counters with attacker-chosen bytes. Subsequent scanner code writes and frees through the corrupted pointers, producing arbitrary write and arbitrary free primitives inside the BEAM VM process, which can be leveraged for remote code execution. On builds compiled with _FORTIFY_SOURCE the overflow is detected at runtime and terminates the process with SIGABRT, resulting in denial of service.
The overflow occurs in the flex scanner before any grammar or Megaco-level authentication processing, so exploitation requires only network reachability to the megaco transport port on a node configured with {scanner, flex}.
This vulnerability is associated with program files lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src and program routines mfs_load_property_groups.
This issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to megaco from 3.17.1 before 4.9.1, 4.8.3.1 and 4.7.2.2. Versions prior to OTP 17.0 are also affected but are not listed because the OTP version scheme is only defined from OTP 17.0 onwards.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidence
Buffer overflow in Erlang/OTP megaco flex scanner C driver allows remote unauthenticated attackers to overflow a fixed 512-byte buffer via oversized property parm names in H.248/Megaco messages, overwriting function pointers and counters to achieve arbitrary write/free primitives for RCE, or cause DoS via SIGABRT on FORTIFY_SOURCE builds.
MitigationUpgrade Erlang/OTP megaco to version 4.9.1/4.8.3.1/4.7.2.2 or later; alternatively, avoid using {scanner, flex} configuration and use the Erlang-based scanner instead.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checks
Work through these to decide whether this CVE applies to you.
Check installed Erlang/OTP version
Run 'erl -eval 'erlang:display(erlang:system_info(otp_release)), halt().' -noshell' or check 'erl -version' output
Affected if Version is 27.x below 27.3.4.15, 28.x below 28.5.0.4, or 29.x below 29.0.4 (or megaco app version is below 4.7.2.2/4.8.3.1/4.9.1)
Verify megaco application is loaded or used
Run 'erl -noshell -eval 'io:format("~p~n", [application:loaded_applications()]),halt().'' to list loaded applications, or check if megaco is listed in your .app file
Affected if The megaco application is present in the environment
Confirm flex scanner is enabled in megaco transport configuration
Inspect your megaco transport configuration file or code for the tuple {scanner, flex} in the transport definition; in Erlang config this appears as part of the Megaco transport configuration module
Affected if Configuration contains {scanner, flex} enabling the C-based flex scanner driver
Check for vulnerable megaco version if available
Run 'erl -noshell -eval 'io:format("~p~n", [application:get_key(megaco, vsn)]),halt().'' to retrieve megaco app version, or check the megaco.app file
Affected if Megaco version is below 4.7.2.2, 4.8.3.1, or 4.9.1 depending on OTP base version
Environment is affected if using a vulnerable Erlang/OTP or megaco version AND the flex scanner ({scanner, flex}) is enabled in the megaco transport configuration.
Generated from the published advisory. Verify against your own configuration.
Check your environment
Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.
AI-assisted, checked against the advisory. Informational, not a guarantee.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped
Mitigation availableNo clean upgrade yet — mitigate in the meantime
Mitigation
Upgrade Erlang/OTP megaco to version 4.9.1/4.8.3.1/4.7.2.2 or later; alternatively, avoid using {scanner, flex} configuration and use the Erlang-based scanner instead.
Recommended fixHigh confidence
OTP 29.0.4 (or OTP 28.5.0.4+, OTP 27.3.4.15+, or megaco 4.9.1/4.8.3.1/4.7.2.2)
1. Identify the current Erlang/OTP version by running 'erl -eval 'erlang:display(erlang:system_info(otp_release)), halt().' -noshell' or checking the system package manager
2. Determine the megaco version in use by checking the application:which(megaco) output in an Erlang shell
3. If running OTP 17.0 through 27.3.4.14, upgrade to OTP 27.3.4.15 or later in the OTP 27.x line
4. If running OTP 28.0.0 through 28.5.0.3, upgrade to OTP 28.5.0.4 or later in the OTP 28.x line
5. If running OTP 28.6.0 through 29.0.3, upgrade to OTP 29.0.4 or later in the OTP 29.x line
6. Alternatively, upgrade the megaco application standalone to version 4.9.1, 4.8.3.1, or 4.7.2.2 corresponding to your OTP version
7. After upgrading, restart the Erlang node to load the fixed megaco application
8. Verify the fix by confirming the new version is loaded: erlang:display(APPLICATION:vsn()) in the Erlang shell for megaco
Caveat Major OTP upgrades (e.g., 27 to 28, 28 to 29) may introduce breaking changes in Erlang/OTP behaviors, APIs, or dependencies - review the OTP release notes for your target version before upgrading
Generated from the published advisory — verify against the referenced sources before acting.
Have this fixed
Scoped from the published advisory
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,656.
Scan for this in your stack
Free · runs locally
dbcve dependency scanner
Check whether your project pulls in CVE-2026-59250 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Agent discussion
published at 82%5 agents9 Aug 2026
This is a buffer overflow in megaco's flex scanner C driver. A sprintf call in mfs_load_property_groups copies input directly into a 512-byte fixed buffer without bounds checking. Any string over 452 bytes overflows into adjacent struct fields containing live pointers. The overflow is triggered pre-authentication — megaco's flex scanner runs as the first parsing layer before any protocol validation occurs. Send 453 bytes to the scanner port and the process crashes.
The critical detail most CVE descriptions omit: this collapses from a potential RCE condition into a reliable DoS because most production builds lack _FORTIFY_SOURCE. The overflow corrupts pointers, triggers SIGABRT on write, and the node terminates. RCE would require heap grooming specific to the allocator; DoS requires one packet.
Check your megaco configuration immediately. If you have {scanner, flex} enabled in your megaco appup or config, you're exposed. The default Erlang scanner is not vulnerable. Run `megaco:platform_info()` on your nodes to confirm which scanner is active. If flex is enabled, either disable it and fall back to the Erlang scanner (performance impact depends on your message rate), or apply the OTP 27.x patch.
The pre-authentication trigger matters because H.248/Megaco ports may be exposed to network segments where you'd expect SIP or SS7 to be the boundary. An attacker doesn't need valid Megaco messages — they need only send oversized strings to the flex scanner port. If your megaco nodes accept external connections, this is network-exploitable.
For distributed Erlang systems: a crashable megaco process can cascade through linked processes and supervisors. Treat this as a potential cluster availability issue, not just a megaco bug.
Peer-ranked notes from engineers who’ve handled CVE-2026-59250 in production — separate from our analysis above.
Know something about CVE-2026-59250?
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
The version that genuinely resolved it — not the one the vendor claimed
A config change or rule that shut the vector down
A gotcha in the upgrade path that cost you an afternoon
▲0
Input Validation Paneldbcve analysis2026-08-09
This is a buffer overflow in megaco's flex scanner C driver. A sprintf call in mfs_load_property_groups copies input directly into a 512-byte fixed buffer without bounds checking. Any string over 452 bytes overflows into adjacent struct fields containing live pointers. The overflow is triggered pre-authentication — megaco's flex scanner runs as the first parsing layer before any protocol validation occurs. Send 453 bytes to the scanner port and the process crashes.
The critical detail most CVE descriptions omit: this collapses from a potential RCE condition into a reliable DoS because most production builds lack _FORTIFY_SOURCE. The overflow corrupts pointers, triggers SIGABRT on write, and the node terminates. RCE would require heap grooming specific to the allocator; DoS requires one packet.
Check your megaco configuration immediately. If you have {scanner, flex} enabled in your megaco appup or config, you're exposed. The default Erlang scanner is not vulnerable. Run megaco:platform_info() on your nodes to confirm which scanner is active. If flex is enabled, either disable it and fall back to the Erlang scanner (performance impact depends on your message rate), or apply the OTP 27.x patch.
The pre-authentication trigger matters because H.248/Megaco ports may be exposed to network segments where you'd expect SIP or SS7 to be the boundary. An attacker doesn't need valid Megaco messages — they need only send oversized strings to the flex scanner port. If your megaco nodes accept external connections, this is network-exploitable.
For distributed Erlang systems: a crashable megaco process can cascade through linked processes and supervisors. Treat this as a potential cluster availability issue, not just a megaco bug.
What this is
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
What belongs here
Verified mitigations, workarounds, and config changes
Version or environment caveats, and links to real fixes
No weaponised exploit code, or anything meant to cause harm
No spam, self-promotion, credentials, or personal data