Description
An integer underflow vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a truncated SUCI in the 5GS Mobile Identity IE. Insufficient length validation in the DecodeSuci() function results in an out-of-bounds heap read, causing the AMF process to crash.
Published: 2026-11-02
Score: n/a
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Update
AI Analysis

Impact

An integer underflow in the NAS decoder of OpenAirInterface CN5G AMF v2.2.1 allows an unauthenticated attacker to send a crafted NAS Registration Request. The truncated SUCI in the 5GS Mobile Identity IE causes an out‑of‑bounds heap read in DecodeSuci(), crashing the AMF process and leading to a denial of service. The weakness is a classic case of improper input validation and integer underflow.

Affected Systems

The flaw resides solely in the OpenAirInterface CN5G AMF component, version 2.2.1. Any deployment of this AMF build in a 5G core network is affected.

Risk and Exploitability

The vulnerability can be triggered via unauthenticated network traffic directed at the AMF. No public exploitation data or EPSS score is available, and the vulnerability is not listed in CISA KEV. Because the attack requires only a crafted NAS message, the practical exploitability is high, yet the impact is limited to a service interruption of the AMF. Network operators should treat this as a medium‑to‑high risk until a fix is applied.

Generated by OpenCVE AI on November 2, 2026 at 18:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the patched OpenAirInterface CN5G AMF release that includes the DecodeSuci() bounds check fix (see the referenced commit for guidance).
  • Configure network segmentation or firewall rules to restrict unauthenticated NAS Registration requests from untrusted elements to the AMF node.
  • Implement automated monitoring to detect AMF crashes and trigger service restart or alerting to mitigate downtime.

Generated by OpenCVE AI on November 2, 2026 at 18:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Nov 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Openairinterface
Openairinterface oai-cn5g-amf
Vendors & Products Openairinterface
Openairinterface oai-cn5g-amf

Mon, 02 Nov 2026 18:45:00 +0000

Type Values Removed Values Added
Title Integer Underflow in AMF NAS Decoder Causing Denial of Service
Weaknesses CWE-190
CWE-20

Mon, 02 Nov 2026 17:30:00 +0000

Type Values Removed Values Added
Description An integer underflow vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a truncated SUCI in the 5GS Mobile Identity IE. Insufficient length validation in the DecodeSuci() function results in an out-of-bounds heap read, causing the AMF process to crash.
References

Subscriptions

Openairinterface Oai-cn5g-amf
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-11-02T17:24:23.856Z

Reserved: 2026-10-27T00:00:00.000Z

Link: CVE-2026-117068

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-02T18:18:43.923

Modified: 2026-11-02T19:35:33.347

Link: CVE-2026-117068

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-02T19:15:16Z

Weaknesses
  • CWE-190

    Integer Overflow or Wraparound

  • CWE-20

    Improper Input Validation