This vulnerability involves an integer underflow in the BIT_BINARY_EXT tag handler of the ETF decoder in Erlang OTP's erts modules. When decoding a specially crafted ETF binary with length and trailing-bits fields set to zero, the calculation of the bitstring size underflows an unsigned integer, resulting in a very large allocation size (~2^64). This triggers the allocator to abort the entire Erlang node with an out-of-memory error. The crash is a VM-level abort, not an Erlang exception, and cannot be intercepted by typical Erlang error handling or the safe option in binary_to_term/2. The vulnerability affects OTP versions from 27.0 before 29.0.4, including OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts versions from 15.0 before 17.0.4, 16.4.0.4, and 15.2.7.11. Applications decoding ETF from untrusted sources are exposed, while the Erlang distribution protocol is expected to operate on trusted networks per OTP Secure Coding Guidelines.

Exploitation causes a VM-level abort due to an out-of-memory allocation request triggered by integer underflow in ETF decoding. This results in denial of service by crashing the Erlang node. The crash cannot be caught or handled by Erlang-level error handling or supervision trees, leading to potential service disruption for applications decoding untrusted ETF data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid decoding ETF data from untrusted sources using binary_to_term/1,2 or enif_binary_to_term(). The Erlang distribution protocol is not considered vulnerable in typical trusted network deployments. No mitigation via the safe option in binary_to_term/2 is effective against this issue.