CVE-2026-37230 Details
Description
FlexRIC v2.0.0 crashes when the near-RT RIC receives a RIC_INDICATION message with a ran_func_id that does not exist in its registry. The lookup returns NULL, triggering assert() in Debug builds (SIGABRT) or NULL pointer dereference in Release builds (SIGSEGV). A remote unauthenticated attacker can crash the near-RT RIC (port 36421) by sending a crafted RIC_INDICATION with an arbitrary ran_func_id value.
A NULL pointer dereference vulnerability has been identified in EURECOM FlexRIC version 2.0.0. This issue occurs in the near-RT RIC when it receives a RIC_INDICATION message containing a ran_func_id that is not registered in its service model registry. The absence of a valid ran_func_id leads to a NULL pointer dereference, causing a crash. In Debug builds, this triggers an assertion failure (SIGABRT), while in Release builds, it results in a segmentation fault (SIGSEGV). A remote, unauthenticated attacker can exploit this vulnerability by sending a crafted RIC_INDICATION with an arbitrary ran_func_id value over SCTP to port 36421.
No upstream fix is currently available. Operators are advised to restrict E2 SCTP access to trusted nodes and to implement validation of ran_func_id values, rejecting indications for unregistered service models without dereferencing a NULL lookup result.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37230.md | [email protected] | ExploitMitigationThird Party Advisory |
| https://gitlab.eurecom.fr/mosaic5g/flexric | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| mosaic5g flexric | 2.0.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 3, 2026 | Initial Analysis | [email protected] |
| Jun 2, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | New CVE Received | [email protected] |