The Erlang/OTP megaco flex scanner C driver contains a buffer overflow in the mfs_load_property_groups routine when processing a property name longer than approximately 452 bytes. This name is unsafely copied into a fixed 512-byte buffer without proper bounds checking, overwriting adjacent memory fields in the MfsErlDrvData struct. The corrupted pointers and counters can be exploited by subsequent scanner code to perform arbitrary writes and frees, enabling remote code execution or denial of service. The overflow occurs before any authentication, requiring only network access to the megaco transport port on nodes configured with {scanner, flex}. Affected OTP versions include OTP 17.0 before 27.3.4.15, OTP 28.0 before 28.5.0.4, and OTP 29.0 before 29.0.4, corresponding to megaco versions 3.17.1 before 4.7.2.2, 4.8 before 4.8.3.1, and 4.9 before 4.9.1. The vendor has released patches addressing this issue.

A remote unauthenticated attacker can exploit this vulnerability to corrupt memory in the Erlang megaco flex scanner driver, potentially causing a denial-of-service crash or achieving remote code execution within the BEAM VM process. The vulnerability is exploitable over the network without authentication, posing a significant risk to affected systems.

A vendor-provided patch is available and should be applied promptly. The issue is fixed in OTP versions 27.3.4.15 and later, 28.5.0.4 and later, and 29.0.4 and later, as well as corresponding megaco versions 4.7.2.2 and later, 4.8.3.1 and later, and 4.9.1 and later. Systems should be updated to these versions or later to remediate the vulnerability. Refer to the Ubuntu security notice USN-8827-1 for specific package updates and instructions.