CVE-2026-106808 Details
Description
OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM Nudm_UEAU Generate Authentication Data endpoint. The UDM passes attacker-controlled resynchronizationInfo.rand and auts values to conv::hex_str_to_uint8(), which converts arbitrary-length hex strings into fixed-size stack buffers without validating the destination size. An unauthenticated attacker with access to the SBI interface and a valid SUPI can submit an oversized value to overwrite adjacent stack memory, corrupt the stack canary, and terminate the UDM process.
A stack-based buffer overflow vulnerability has been identified in OpenAirInterface Core Network (OAI CN5G UDM) version 2.2.1. The issue arises in the Nudm_UEAU Generate Authentication Data endpoint, where the User Data Management (UDM) component improperly validates input from the resynchronizationInfo.rand and auts fields. This unchecked data is passed to a utility function that converts hexadecimal strings into byte arrays, allowing an unauthenticated attacker with access to the Service-Based Interface (SBI) and a valid Subscription Permanent Identifier (SUPI) to send oversized values. The exploitation overwrites adjacent stack memory, corrupts the stack canary, and causes the UDM process to crash, leading to a denial-of-service condition. This vulnerability could potentially be leveraged for arbitrary code execution by manipulating the overflowed data, especially if the stack canary protection is bypassed or defeated.
Users are advised to update to the patched version of OpenAirInterface Core Network UDM, which includes validation for the resynchronizationInfo lengths to prevent buffer overflow vulnerabilities.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 2, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openairinterface/oai-cn5g-udm/issues/4 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://gist.github.com/hackeryounow/66b7612729af8e205089097e68a42116 | [email protected] | Technical Description |
| https://github.com/openairinterface/oai-cn5g-udm/issues/4 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| OpenAirInterface Core Network | v2.2.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Nov 2, 2026 | New CVE Received | [email protected] |