CVE-2026-117069 Details
Description
An integer truncation vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a malformed IMEISV in the 5GS Mobile Identity IE. The Type6NasIe::Validate() function truncates a 32-bit length value to 16 bits, bypassing length validation and causing an out-of-bounds heap read in DecodeImeisv(), which can crash the AMF process.
A denial-of-service vulnerability has been identified in OpenAirInterface (OAI) CN5G AMF version 2.2.1. The issue arises from an integer truncation flaw in the NAS decoder, specifically within the Type6NasIe validation process. This vulnerability allows an unauthenticated remote attacker to cause a crash in the AMF process by sending crafted NAS Registration Requests that include a malformed IMEISV in the 5GS Mobile Identity information element. The truncation occurs when a 32-bit length value is reduced to 16 bits, bypassing proper length validation and leading to an out-of-bounds heap read. This exploitation can disrupt the AMF's control-plane services, causing interruptions in active UE registrations and disrupting communication with connected gNBs.
A pull request has been made to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 2, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openairinterface/oai-cn5g-amf/issues/16 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://gist.github.com/hackeryounow/1c6741be7d536bd98434ac270dbb1f60 | [email protected] | Technical Description |
| https://github.com/openairinterface/oai-cn5g-amf/issues/16 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-197 | Numeric Truncation Error | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| OpenAirInterface Core Network | v2.2.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Nov 2, 2026 | New CVE Received | [email protected] |