CVE-2026-117068 Details
Description
An integer underflow vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a truncated SUCI in the 5GS Mobile Identity IE. Insufficient length validation in the DecodeSuci() function results in an out-of-bounds heap read, causing the AMF process to crash.
A denial-of-service vulnerability has been identified in OpenAirInterface (OAI) CN5G AMF version 2.2.1. The issue arises from an integer underflow in the NAS decoder, specifically in the DecodeSuci() function. This vulnerability allows an unauthenticated remote attacker to cause a crash by sending crafted NAS Registration Requests with a truncated SUCI in the 5GS Mobile Identity Information Element. The lack of proper length validation enables an out-of-bounds heap read, disrupting the AMF process.
Users can update to OpenAirInterface CN5G AMF version 2.2.2, which includes a patch for this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 2, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openairinterface/oai-cn5g-ausf/issues/7 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://gist.github.com/hackeryounow/aa1df06bb785bda0952a30939dcb9a76 | [email protected] | Technical Description |
| https://github.com/openairinterface/oai-cn5g-amf/pull/26/commits/c5178c644f87c5ef8828353192fea464d977e17b | [email protected] | Source CodeVendor |
| https://github.com/openairinterface/oai-cn5g-ausf/issues/7 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-191 | Integer Underflow (Wrap or Wraparound) | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| OpenAirInterface Core Network | v2.2.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 2, 2026 | New CVE Received | [email protected] |