The vulnerability CVE-2026-49760 is a stack-based buffer overflow in the Erlang OTP erl_interface component, specifically in the ei_s_print_term function within lib/erl_interface/src/misc/ei_printterm.c. This function uses a fixed-size 2000-character stack buffer to format Erlang terms. When processing an encoded Erlang term containing a very large integer with an encoded representation exceeding 2000 characters, the buffer overflows. The overflowed bytes are limited to ASCII digits and uppercase hexadecimal letters, which constrains the exploitability to denial of service rather than arbitrary code execution. The companion function ei_print_term, which outputs directly to a FILE stream, does not exhibit this vulnerability. Affected versions include OTP releases from 17.0 before 29.0.2, 28.5.0.2, and 27.3.4.13, and erl_interface versions from 3.7.16 before 5.8.1, 5.7.0.1, and 5.5.2.1. No official patch or remediation level is provided in the available data.

The buffer overflow can cause a denial of service condition due to stack corruption when processing specially crafted large integer terms. Exploitation is limited to denial of service because the overflowed data is restricted to ASCII characters 0-9 and A-F, preventing arbitrary code execution or other more severe impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor Erlang OTP vendor advisories for updates. Avoid using the vulnerable function ei_s_print_term with untrusted or excessively large encoded terms as a temporary mitigation.