CVE-2026-117068

Full vulnerability record from the local CVENow database.

Description

An integer underflow vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a truncated SUCI in the 5GS Mobile Identity IE. Insufficient length validation in the DecodeSuci() function results in an out-of-bounds heap read, causing the AMF process to crash.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-11-02 18:18:43.923000

Last modified

2026-11-02 19:35:33.347000

View original CVE JSON

{
  "id": "CVE-2026-117068",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-02T18:18:43.923",
  "lastModified": "2026-11-02T19:35:33.347",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An integer underflow vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a truncated SUCI in the 5GS Mobile Identity IE. Insufficient length validation in the DecodeSuci() function results in an out-of-bounds heap read, causing the AMF process to crash."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://gist.github.com/hackeryounow/aa1df06bb785bda0952a30939dcb9a76",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/openairinterface/oai-cn5g-amf/pull/26/commits/c5178c644f87c5ef8828353192fea464d977e17b",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/openairinterface/oai-cn5g-ausf/issues/7",
      "source": "[email protected]"
    }
  ]
}