CVE-2026-59250

This is a buffer overflow in megaco's flex scanner C driver. A sprintf call in mfs_load_property_groups copies input directly into a 512-byte fixed buffer without bounds checking. Any string over 452 bytes overflows into adjacent struct fields containing live pointers. The overflow is triggered pre-authentication — megaco's flex scanner runs as the first parsing layer before any protocol validation occurs. Send 453 bytes to the scanner port and the process crashes. The critical detail most CVE descriptions omit: this collapses from a potential RCE condition into a reliable DoS because most production builds lack _FORTIFY_SOURCE. The overflow corrupts pointers, triggers SIGABRT on write, and the node terminates. RCE would require heap grooming specific to the allocator; DoS requires one packet. Check your megaco configuration immediately. If you have {scanner, flex} enabled in your megaco appup or config, you're exposed. The default Erlang scanner is not vulnerable. Run `megaco:platform_info()` on your nodes to confirm which scanner is active. If flex is enabled, either disable it and fall back to the Erlang scanner (performance impact depends on your message rate), or apply the OTP 27.x patch. The pre-authentication trigger matters because H.248/Megaco ports may be exposed to network segments where you'd expect SIP or SS7 to be the boundary. An attacker doesn't need valid Megaco messages — they need only send oversized strings to the flex scanner port. If your megaco nodes accept external connections, this is network-exploitable. For distributed Erlang systems: a crashable megaco process can cascade through linked processes and supervisors. Treat this as a potential cluster availability issue, not just a megaco bug.

Reviewed through automated stages and approved by a human before publication.