The vulnerability CVE-2026-49759 is a stack-based buffer overflow in the sctp_parse_error_chunk function of the Erlang OTP erts inet_drv module. This function parses SCTP ERROR chunks and writes cause codes into a fixed-size stack-allocated array without proper bounds checking. An attacker who has established an SCTP association can send a crafted SCTP ERROR chunk with enough cause codes to overflow this stack buffer, causing the BEAM VM to crash. The overflow only allows writing 16-bit values interleaved with a fixed tag, preventing controlled return address manipulation and limiting exploitation to denial of service. Additionally, the crafted chunk may leak fragments of Erlang VM memory in the error packet, but this data is already accessible to the user running the VM, limiting the impact of information disclosure. The affected versions include OTP from 17.0 up to but not including 27.3.4.13, 28.5.0.2, and 29.0.2, and corresponding erts versions from 6.0 up to but not including 15.2.7.9, 16.4.0.2, and 17.0.2.

An unauthenticated remote attacker can cause a denial of service by crashing the Erlang BEAM VM through a stack-based buffer overflow triggered by a crafted SCTP ERROR chunk. The vulnerability does not allow code execution or privilege escalation. Limited information disclosure may occur but only exposes memory already accessible to the Erlang VM user, so it does not increase the risk of sensitive data leakage beyond existing permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix links are provided in the available data. Users should monitor the Erlang and Red Hat advisories for updates and apply any official fixes once released. In the meantime, restricting SCTP access to trusted sources and limiting exposure of Erlang services using SCTP may reduce risk.