Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (and potentially achieve remote code execution or a denial-of-service crash) by sending a single text-encoded H.248/Megaco message containing an oversized property parm name. When tokenizing a Local/Remote descriptor, mfs_load_property_groups extracts the attacker-controlled property name (bounded only by the message length) and, when no value follows, formats it into a fixed 512-byte error_msg field of the MfsErlDrvData struct using an unchecked sprintf call. Names longer than roughly 452 bytes overflow into the immediately following struct fields (text_buf, text_ptr, term_spec, term_spec_size, term_spec_index), overwriting live pointers and counters with attacker-chosen bytes. Subsequent scanner code writes and frees through the corrupted pointers, producing arbitrary write and arbitrary free primitives inside the BEAM VM process, which can be leveraged for remote code execution. On builds compiled with _FORTIFY_SOURCE the overflow is detected at runtime and terminates the process with SIGABRT, resulting in denial of service. The overflow occurs in the flex scanner before any grammar or Megaco-level authentication processing, so exploitation requires only network reachability to the megaco transport port on a node configured with {scanner, flex}. This vulnerability is associated with program files lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src and program routines mfs_load_property_groups. This issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to megaco from 3.17.1 before 4.9.1, 4.8.3.1 and 4.7.2.2. Versions prior to OTP 17.0 are also affected but are not listed because the OTP version scheme is only defined from OTP 17.0 onwards.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated     attacker to corrupt the driver's memory (and potentially achieve remote code execution or a denial-of-     service crash) by sending a single text-encoded H.248/Megaco message containing an oversized property parm     name. When tokenizing a Local/Remote descriptor, mfs_load_property_groups extracts the attacker-controlled     property name (bounded only by the message length) and, when no value follows, formats it into a fixed     512-byte error_msg field of the MfsErlDrvData struct using an unchecked sprintf call. Names longer than     roughly 452 bytes overflow into the immediately following struct fields (text_buf, text_ptr, term_spec,     term_spec_size, term_spec_index), overwriting live pointers and counters with attacker-chosen bytes.
    Subsequent scanner code writes and frees through the corrupted pointers, producing arbitrary write and     arbitrary free primitives inside the BEAM VM process, which can be leveraged for remote code execution. On     builds compiled with _FORTIFY_SOURCE the overflow is detected at runtime and terminates the process with     SIGABRT, resulting in denial of service. The overflow occurs in the flex scanner before any grammar or     Megaco-level authentication processing, so exploitation requires only network reachability to the megaco     transport port on a node configured with {scanner, flex}. This vulnerability is associated with program     files lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src and program routines mfs_load_property_groups.
    This issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to     megaco from 3.17.1 before 4.9.1, 4.8.3.1 and 4.7.2.2. Versions prior to OTP 17.0 are also affected but are     not listed because the OTP version scheme is only defined from OTP 17.0 onwards. (CVE-2026-59250)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 445da2cc-89e1-11f1-b35c-4c526214c986 advisory.

    https://github.com/erlang/otp/security/advisories/GHSA-7xgh-gmgf-q2g7 reports:
    A remote unauthenticated attacker can crash Erlang nodes               running the megaco text codec with the flex scanner option by               sending an H.248/Megaco message with a property parm name               exceeding 452 bytes. The overflow occurs in a C linked-in               driver, causing the entire BEAM VM process to terminate. It is               reachable pre-authentication, as the flex scanner processes               raw TCP payloads before protocol validation.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
330404	Linux Distros Unpatched Vulnerability : CVE-2026-59250	Nessus	Misc.	high
330269	FreeBSD : Erlang/OTP -- megaco flex scanner buffer overflow (445da2cc-89e1-11f1-b35c-4c526214c986)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2026-59250

high

Tenable Plugins

high

high