This vulnerability is a buffer overflow in the Erlang/OTP megaco flex scanner C driver, specifically in the function mfs_load_property_groups. When processing a Local/Remote descriptor, the driver extracts a property name from an attacker-controlled message without properly checking its size. If the property name exceeds approximately 452 bytes, it overflows a fixed 512-byte buffer (error_msg field) in the MfsErlDrvData struct via an unchecked sprintf call. This overflow corrupts adjacent struct fields, including pointers and counters, leading to arbitrary memory write and free operations. These primitives can be exploited for remote code execution within the BEAM VM process. On systems compiled with _FORTIFY_SOURCE, the overflow triggers a runtime abort (SIGABRT), causing denial of service. The vulnerability is exploitable remotely without authentication, requiring only network reachability to the megaco transport port on nodes configured with {scanner, flex}. Affected versions include OTP from 17.0 before 29.0.4, 28.5.0.4, and 27.3.4.15, and megaco from 3.17.1 before 4.9.1, 4.8.3.1, and 4.7.2.2.

Successful exploitation allows a remote unauthenticated attacker to corrupt memory in the Erlang/OTP megaco flex scanner driver, potentially leading to remote code execution or denial of service by crashing the process. The vulnerability occurs before any authentication or grammar processing, making it exploitable solely via network access to the megaco transport port. On hardened builds with _FORTIFY_SOURCE, exploitation results in process termination (denial of service) rather than code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the megaco transport port on nodes configured with {scanner, flex} to trusted sources only. Monitor for updates from the Erlang/OTP project regarding official patches or mitigations.