The vulnerability is an integer underflow in the BIT_BINARY_EXT tag handler of the External Term Format decoder in Erlang OTP erts modules. When both length and trailing-bits fields are zero, the bitstring size calculation underflows an unsigned integer, producing a very large size (~2^64). This size is passed to the memory allocator, which aborts the Erlang VM with a memory allocation error. The abort is a VM-level crash, not an Erlang exception, and cannot be intercepted by supervision trees or try/catch blocks. Any application decoding ETF from untrusted sources via binary_to_term/1,2 or enif_binary_to_term() is exposed. The Erlang distribution protocol also uses this code path but is intended for trusted networks. Affected OTP versions include OTP 27.0 before OTP 29.0.4, OTP 28.5.0.4, and OTP 27.3.4.15, corresponding to erts versions 15.0 before 17.0.4, 16.4.0.4, and 15.2.7.11.

Exploitation causes the Erlang VM to abort due to a forced integer underflow leading to an excessive memory allocation request. This results in a denial of service (DoS) at the VM level. The crash cannot be caught or handled by Erlang-level mechanisms, making recovery without restarting the node impossible. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, avoid decoding External Term Format (ETF) data from untrusted sources using binary_to_term/1,2 or enif_binary_to_term(). The Erlang distribution protocol is expected to run only on trusted networks, which mitigates risk in typical deployments. No Erlang-level exception handling or safe options prevent this crash.