The vulnerability in Erlang OTP erts involves a mismatch in how the LARGE_TUPLE_EXT term's 32-bit arity field is interpreted during validation and decoding. The validation pass reads the arity as an unsigned integer, while the decode pass reads it as a signed integer. This discrepancy allows an attacker to supply a crafted external term format binary with a specific arity value (0x80000000) that passes validation but decodes as a negative number, causing the heap pointer to move backward. This out-of-bounds write corrupts the BEAM heap pointer and crashes the virtual machine. The vulnerability affects OTP versions from 25.0 before 29.0.4, including OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to erts versions from 13.0 before 17.0.4, 16.4.0.4, and 15.2.7.11 respectively.

An attacker who can supply a crafted Erlang external term format binary to the binary_to_term/1 function can cause the Erlang virtual machine to crash due to heap pointer corruption. This results in a denial of service condition. There is no indication of code execution or privilege escalation. The impact is limited to denial of service via VM crash.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is provided in the available data. Users should monitor Erlang OTP vendor advisories for updates and apply patches once available. Until then, avoid processing untrusted external term format binaries with binary_to_term/1.