CVE-2026-59250

Executive Summary

CVE-2026-59250 is a critical buffer overflow vulnerability in the Erlang/OTP megaco flex scanner C driver, allowing a remote unauthenticated attacker to achieve arbitrary code execution or denial of service on affected nodes. The vulnerability stems from an unchecked sprintf call in mfs_load_property_groups that writes attacker-controlled data into a fixed 512-byte buffer, overflowing into adjacent struct fields and enabling memory corruption primitives. Affected systems are those running Erlang/OTP with the {scanner, flex} option configured for H.248/Megaco protocol handling, exposed on the network transport port (typically 2944).

Technical Analysis

The vulnerability resides in the flex scanner component of Erlang/OTP's megaco application (lib/megaco/src/flex/megaco_flex_s). The scanner is responsible for tokenizing incoming H.248/Megaco text-encoded messages before they reach the grammar parser. When processing a Local or Remote descriptor within a message, the code path invokes mfs_load_property_groups, which is tasked with extracting property parameter names for further processing.

The core flaw lies in the error-handling path. When a property parameter name is provided without a following value (i.e., a syntactically malformed message), the function formats the attacker-controlled property name into a fixed 512-byte error_msg field within the MfsErlDrvData struct. This is accomplished using an unchecked sprintf call:

sprintf(error_msg, "property name too long: %s", attacker_name);

There is no bounds checking on the attacker-controlled attacker_name string. The property name length is limited only by the total message length, which for a single Megaco message can be far larger than 512 bytes. A property name exceeding roughly 452 characters causes an overflow into the MfsErlDrvData struct's subsequent fields:

1. text_buf — a character buffer pointer
2. text_ptr — a positional pointer within text_buf
3. term_spec — a term specification structure pointer
4. term_spec_size — an integer counter
5. term_spec_index — an integer index

These adjacent fields contain live pointers and counters used by the scanner's internal state machine. By carefully controlling the overflow bytes, an attacker overwrites these fields with chosen values. The overwritten pointers are subsequently dereferenced and used in write operations and free operations during the remainder of the scanning process. This yields:

• Arbitrary write primitive: The scanner writes token data through text_ptr/text_buf into attacker-controlled memory locations.
• Arbitrary free primitive: A corrupted term_spec pointer is passed to the memory allocator's free routine, allowing free() on an arbitrary address.

These primitives exist entirely within the BEAM VM process memory space. Combined, they enable heap grooming and the construction of a full read/write primitive that can be escalated to arbitrary code execution in the VM process context. The actual code execution flavor — whether via function pointer overwrite, GOT relocation, or heap metadata corruption — depends on the specific memory layout and process hardening.

On builds compiled with _FORTIFY_SOURCE (common in Linux distributions), the overflow triggers a runtime abort in __sprintf_chk, causing immediate process termination with SIGABRT. In this configuration, the vulnerability degrades to a straightforward denial-of-service vector, requiring only a single crafted packet to crash the node.

The overflow occurs entirely within the flex scanner layer, before any Megaco-level authentication, grammar validation, or application logic executes. This means no prior protocol negotiation, no session state, and no credentials are required — only network reachability to the megaco transport port on a node configured with {scanner, flex}.

Exploitation Scenarios

A remote attacker with no prior access can exploit this vulnerability through the following step-by-step chain:

Step 1 — Reconnaissance and Target Identification: The attacker scans for hosts listening on TCP/UDP port 2944 (default Megaco/H.248 transport port) or any custom port configured for megaco. A Shodan search using port:2944 or H.248 reveals internet-exposed Erlang nodes running megaco. To confirm the vulnerable configuration, the attacker sends a benign but malformed Megaco message and observes either a protocol error response (indicates the node is reachable and processing H.248) or a connection reset (indicates the flex scanner is present and possibly vulnerable).

Step 2 — Trigger and Weaponization: The attacker crafts a single text-encoded H.248/Megaco message with a Local or Remote descriptor containing a property parameter name of approximately 500-2000 bytes, with no value following it. The message structure is:

MEGACO/1 [10.0.0.5]:2944
Transaction = 1 {
    Context = - {
        Add = A1 {
            Media {
                Local {
                     descriptor = { propertyAAAAAA...AAAA }
                }
            }
        }
    }
}

The property name (property followed by A × N) is what the scanner tokenizes. The attacker precisely controls the overflow bytes (the trailing portion of the property name) to overwrite the struct fields with chosen values. No value follows the property name, satisfying the error path condition that triggers the vulnerable sprintf.

Step 3 — Payload Execution and Memory Corruption: The attacker tailors the overflow payload to the target's architecture (32-bit vs 64-bit pointer sizes dictate padding and alignment). In the first phase, a payload designed for information disclosure writes a term_spec pointer that causes the scanner to read memory from a controlled location and subsequently send it back in a protocol response — leaking heap addresses and BEAM VM internal structures. In the second phase, the attacker uses the arbitrary write primitive to overwrite a function pointer used during scanner shutdown or cleanup, redirecting execution to a ROP chain or shellcode placed in the overwritten text_buf region. Alternatively, the attacker overwrites the term_spec pointer to point to a fake term_data structure, triggering allocation of a controlled chunk in the heap, then uses the arbitrary free to corrupt heap metadata for a classic house-of-force style attack.

Step 4 — Post-Exploitation Impact: Upon successful code execution, the attacker gains code execution in the context of the BEAM VM process. From there, they can: pivot to the Erlang distribution port (often EPMD on 4369 or the distribution port range 4370+), extract environment variables and credentials from the VM's process memory (including os.getenv data accessible to the VM), enumerate and download any Erlang modules loaded in the runtime, or use the VM's networking capabilities to stage lateral movement into internal networks. On systems where the megaco node runs as root (misconfiguration), this escalates to full system compromise. In the denial-of-service variant (FORTIFY_SOURCE builds), the attacker simply floods the target with oversized property messages to repeatedly crash the VM, causing service unavailability; given the single-packet nature, this can be done asynchronously with a loop of crafted packets.

Impact Assessment

The business impact is high-dimensional:

• Confidentiality: An attacker achieving RCE can read VM memory containing authentication tokens, session cookies, and any data processed by the node, violating confidentiality of call-control signaling data.
• Integrity: Arbitrary memory write allows modification of VM state, including scripting interpreter globals, node configurations, and message routing logic, enabling signaling-plane attacks (redirecting calls, injecting false media setup commands).
• Availability: Even without RCE, a single packet reliably crashes the VM on FORTIFY_SOURCE builds. For non-fortified builds, a crashed scanner corrupts the driver's internal state, potentially producing cascading failures in the telephony application. Repeated exploitation yields sustained DoS.

The blast radius includes any telephony/VoIP infrastructure relying on Erlang megaco for media gateway control: softswitches, media gateways, session border controllers, and carrier-grade SBCs. In enterprise environments, this often involves real-time voice infrastructure where availability is an SLA-critical metric.

CVSS vector is N/A due to missing scoring data, but independent scoring by analogy to similar scanner buffer overflows with remote trigger and memory corruption impact places this in the 9.0–10.0 critical range. The EPSS probability of 0.00730 (50.7th percentile) indicates moderate exploitability likelihood — not yet weaponized in the wild, but the ease of triggering (single packet, no auth) makes this an attractive target for threat actors once knowledge spreads. The CISA KEV listing does not currently include this CVE, indicating no confirmed in-the-wild exploitation as of this report.

Detection Guidance

Sigma Rule

title: Megaco Flex Scanner Buffer Overflow - Oversized Property Name
id: 6e8f2345-9c2a-4b6e-8d7c-12a3b4d5e6f7
status: experimental
description: Detects network packets to Megaco/H.248 ports containing excessively long property parameter names exceeding the 452-byte threshold required to trigger CVE-2026-59250 buffer overflow.
author: Valtersit Threat Intel
date: 2026/01/15
logsource:
  category: network_connection
  product: suricata
detection:
  selection_megaco_port:
    destination.port:
      - 2944
      - 2945
  selection_property_length:
    # Proxy for oversized property name in local/remote descriptor
    # Requires protocol-aware parsing (e.g., Zeek/extraction)
    event.category: network
    event.type: connection
    # Condition placeholder - real rule requires parsing payload for
    # "property" token followed by >452 bytes no value delimiter
  condition: selection_megaco_port and selection_property_length
  timeframe: 5m
level: high
falsepositives:
  - Legitimate large configurations containing long property names (extremely rare)
  - Malformed messages from buggy but benign agents
tags:
  - attack.t1190
  - cve.2026.59250

YARA Rule

rule megaco_flex_scanner_overflow_cve_2026_59250 {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects Megaco/H.248 payloads with property name lengths exceeding 452 bytes, indicative of CVE-2026-59250 exploitation attempts"
        date = "2026-01-15"
        cve = "CVE-2026-59250"
        severity = "critical"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-59250"
    strings:
        $megaco_hm = "MEGACO/"
        $local_desc = "Local" ascii
        $remote_desc = "Remote" ascii
        $property_kw = "property" ascii nocase
        $property_alt = "prop" ascii nocase
    condition:
        $megaco_hm at 0 and (
            ($local_desc or $remote_desc) and
            ($property_kw or $property_alt) and
            # property name appears before a descriptor value terminator
            filesize > 600
        )
}

Note: This rule relies on a heuristic based on message size and the presence of long property tokens. PCAP-based detection may require extracting the payload from the network layer first. For memory-based hunting, adjust to scan for the specific byte pattern of a 512-byte error_msg overwrite sequence.

Suricata IDS Rule

alert tcp any any -> any 2944 (msg:"ET EXPLOIT Erlang Megaco Flex Scanner Buffer Overflow Attempt CVE-2026-59250"; flow:to_server,established; content:"MEGACO/"; within:16; content:"Local"; nocase; distance:0; content:"property"; nocase; within:200; pcre:"/(?s)property\s*=\s*\{[^\}]{452,}/"; classtype:attempted-admin; reference:cve,2026-59250; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-59250; sid:2026059250; rev:1; metadata:created_at 2026_01_15, updated_at 2026_01_15;)

alert udp any any -> any 2944 (msg:"ET EXPLOIT Erlang Megaco Flex Scanner Buffer Overflow Attempt CVE-2026-59250 UDP"; flow:to_server; content:"MEGACO/"; within:16; content:"Remote"; nocase; distance:0; content:"property"; nocase; within:200; pcre:"/(?s)property\s*=\s*\{[^\}]{452,}/"; classtype:attempted-admin; reference:cve,2026-59250; sid:2026059251; rev:1; metadata:created_at 2026_01_15, updated_at 2026_01_15;)

Elastic Detection

network where event.category == "network" and event.type == "connection" and
  destination.port in (2944, 2945) and
  /* Only flag messages where property name exceeds 452 bytes */
  (
    /* Placeholder for protocol-specific parsing; use a custom pipeline
       extracting Megaco payload length and property token lengths */
    network.bytes > 600 and
    process.name == "beam.smp"
  )

// Process-level detection for SIGABRT on FORTIFY_SOURCE builds
process where event.action == "end" and
  process.name == "beam.smp" and
  process.exit_code == 134 and
  /* Crash occurred within a recent window where megaco traffic was seen */
  /* Join on host and time window */
  process.parent.name == "init"

Splunk SPL Query

index=network sourcetype="suricata" (dest_port=2944 OR dest_port=2945)
| spath output=msg_type path=event_type
| where msg_type=="alert"
| search signature_id IN (2026059250, 2026059251)
| table _time, src_ip, dest_ip, dest_port, sig_name, signature_id
| stats count by src_ip, dest_ip, dest_port
| where count > 3
| outputlookup megaco_exploit_sources.csv

index=os sourcetype="syslog" "SIGABRT" "beam.smp"
| rex field=_raw "process (?P<pid>\d+)"
| eval vulnerable_scanner = if(match(_raw, "flex scanner") OR match(_raw, "megaco"), 1, 0)
| where vulnerable_scanner == 1
| table _time, host, pid, _raw
| transaction host span=10m
| where eventcount > 2
| sort -_time

Wazuh OSSEC Rule

<group name="megaco,erlang,cve_2026_59250,">
  <rule id="937972" level="15">
    <decoded_as>syslog</decoded_as>
    <field name="program_name">beam.smp</field>
    <match>flex scanner|megaco_flex_s|sprintf|buffer overflow</match>
    <description>Erlang beam.smp megaco flex scanner crash detected - possible CVE-2026-59250 exploitation</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_59250,erlang,megaco,</group>
  </rule>

  <rule id="937973" level="12">
    <decoded_as>network</decoded_as>
    <if_sid>59250</if_sid>
    <match>2944|2945</match>
    <description>Megaco/H.248 traffic on standard port associated with crashed beam process - possible exploit attempt</description>
    <group>cve_2026_59250,erlang,megaco,</group>
  </rule>

  <rule id="937974" level="15">
    <decoded_as>syslog</decoded_as>
    <field name="program_name">beam.smp</field>
    <match>SIGABRT</match>
    <regex>_FORTIFY_SOURCE|__sprintf_chk</regex>
    <description>FORTIFY_SOURCE detected buffer overflow in beam - CVE-2026-59250 likely triggered (DoS)</description>
    <group>cve_2026_59250,erlang,megaco,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Immediate Mitigations:

1. Switch scanners: Remove {scanner, flex} from the megaco encoder configuration, falling back to the default Erlang-based scanner. The Erlang scanner is unaffected by this C-level memory corruption. Apply this as an emergency change via release configuration or runtime parameter in mnesia/application environment.
2. Network segmentation: Restrict access to the megaco transport port (2944/2945) using stateful firewall rules or access control lists. Allow only known media gateway peers and operator OSS/BSS IP ranges.
3. Run as non-root: Ensure the BEAM VM process runs under a dedicated low-privilege service account rather than root.

Patch/Upgrade Steps:

1. Monitor the Erlang/OTP security advisory page for the official patch release.
2. Upon official release, upgrade to the patched version for your distribution channel. For OTP sources, apply the specific commit(s) referenced in OSV after verifying integrity with git verify-commit.
3. Test the upgraded node in a staging environment with synthetic Megaco traffic, verifying scanner behavior and throughput.

Long-Term Hardening:

1. Compile Erlang/OTP with _FORTIFY_SOURCE=2 and other compiler hardening flags (stack protector, PIE/ASLR) to convert potential RCE into a denial-of-service — reducing attack impact to a crash rather than code execution.
2. Implement network-level intrusion prevention signatures as provided in the Suricata rule above across all perimeter and internal chokepoints.
3. Ensure the megaco service is not internet-exposed; require VPN or dedicated transport for H.248 signaling.
4. Audit all Erlang/OTP nodes for the {scanner, flex} configuration using code search or configuration management tools (Ansible/Chef/Puppet).
5. Consider migrating from the flex scanner to the Erlang scanner permanently; while parsing throughput is lower, the security posture improvement justifies the performance trade-off for most workloads.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-59250
2. OSV Advisory Database: https://osv.dev/vulnerability/CVE-2026-59250 (contains patch references and affected package metadata)
3. Erlang/OTP Security Advisories: https://erlang.org/security (official vendor page — monitoring point for the pending patch release)
4. CISA Known Exploited Vulnerabilities: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (monitor for future addition; currently not listed — no confirmed in-the-wild exploitation as of this report)

No active threat-actor campaigns exploiting CVE-2026-59250 have been identified at the time of writing. The EPSS score of 0.00730 indicates moderate probability of exploitation in the next 30 days, consistent with a freshly disclosed CVE lacking public PoC. However, the trivial single-packet trigger and lack of authentication requirements make this an attractive target for opportunistic botnet operators and APT groups specializing in telephony infrastructure. Organizations operating Erlang-based telephony stacks should treat this as a priority-1 remediation item despite the patch confidence level.