LiveActive security incident?Get immediate response
CVE Record

CVE-2016-10253: An issue was discovered in Erlang/OTP 18.x.

An issue was discovered in Erlang/OTP 18.x. Erlang's generation of compiled regular expressions is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset that is used as an array index. This ordinal permits arbitrary regions within the erts_alloc arena to be both read and written to.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2016-10253 is a memory corruption flaw in Erlang/OTP 18.x regular expression compilation. A malformed extended pattern could cause heap overflow behavior, allowing reads and writes within Erlang's allocator arena. Business urgency depends on whether legacy Erlang/OTP 18.x is still deployed and processes untrusted regular expressions.

Executive priority

Treat as a targeted legacy-risk cleanup item with high technical impact. Prioritize systems that are internet-facing, process customer-supplied patterns, or run unsupported Erlang/OTP 18.x. No provided source supports emergency active-exploitation response.

Technical view

Erlang/OTP 18.x generated compiled regular expressions incorrectly for malformed extpatterns. The flaw could indirectly set an offset used as an array index, allowing arbitrary regions inside the erts_alloc arena to be read and written. The provided sources do not include CVSS, CWE, full affected package ranges, or exploit prerequisites.

Likely exposure

Most likely exposure is legacy systems still running Erlang/OTP 18.x, especially services that compile regular expressions from user-controlled or external input. The supplied data does not identify affected downstream packages beyond the Erlang/OTP 18.x statement.

Exploitation context

The provided sources do not show active exploitation, and the CVE is not listed as KEV in the bundle. The technical impact is serious memory corruption, but the bundle does not provide proof-of-concept status, remote attack conditions, or exploit maturity.

Researcher notes

The key issue is malformed extpattern handling during compiled regex generation, leading to attacker-influenced indexing into the erts_alloc arena. Evidence is incomplete for exact patched versions, exploitability boundaries, and affected distributions beyond Erlang/OTP 18.x and Ubuntu's advisory reference.

Mitigation direction

  • Inventory systems and applications running Erlang/OTP 18.x.
  • Review Ubuntu USN-3571-1 and upstream Erlang/OTP PR 1108 for fixed package guidance.
  • Upgrade affected Erlang/OTP packages through supported vendor channels.
  • Avoid compiling untrusted regular expressions on legacy Erlang/OTP until remediated.
  • Retire unsupported Erlang/OTP 18.x deployments where practical.

Validation and detection

  • Check Erlang/OTP versions on production, CI, build, and packaged runtime hosts.
  • Identify services that accept or generate regular expressions from external input.
  • Confirm vendor package updates align with USN-3571-1 or upstream fixes.
  • Review logs and crash reports for regex compilation failures or VM instability.
  • Document compensating controls if immediate upgrade is not possible.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2016-10253 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.