The vulnerability exists in the sctp_parse_error_chunk function within the inet_drv driver of Erlang OTP's erts component. This function parses SCTP ERROR chunks and writes cause codes into a fixed-size, stack-allocated array without proper bounds checking. An attacker who has established an SCTP association to a listening port can send a crafted SCTP ERROR chunk with enough cause codes to overflow this stack buffer, causing the BEAM VM to crash. The overflow only allows writing 16-bit values interleaved with a fixed tag, preventing controlled return address manipulation and limiting the impact to denial of service. Additionally, crafted chunks may leak small amounts of Erlang VM memory, but this data is already accessible to the user running the VM, limiting the disclosure impact. The affected versions include OTP from 17.0 before 29.0.2, 28.5.0.2, and 27.3.4.13, corresponding to erts versions from 6.0 before 17.0.2, 16.4.0.2, and 15.2.7.9 respectively. The CVSS 4.0 score is 8.8 (high severity), reflecting network attack vector, no privileges required, no user interaction, and high impact on availability.

Successful exploitation results in a denial of service by crashing the Erlang BEAM VM. There is limited information disclosure of VM memory, but this does not increase the risk significantly as the data is already accessible to the VM user. There is no indication of remote code execution or privilege escalation from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisory linked does not specify an official fix or workaround at this time. Users should monitor the vendor advisory for updates and apply any official patches once available. Until then, restricting SCTP access to trusted sources may reduce exposure.