An integer truncation flaw in the NAS decoder of OpenAirInterface CN5G AMF version 2.2.1 causes a 32‑bit length field to be truncated to 16 bits during validation of a 5GS Mobile Identity IE. The resulting impermissible value bypasses length checks and leads to an out‑of‑bounds heap read in DecodeImeisv(), which can crash the AMF process. The vulnerability can be triggered by a specially crafted NAS Registration Request containing a malformed IMEISV, giving a remote attacker the ability to cause a denial‑of‑service without requiring authentication or privileged access.

The defect affects OpenAirInterface CN5G AMF version 2.2.1. All installations running this exact release are vulnerable when they process NAS Registration Requests that include a 5GS Mobile Identity IE with a length field that exceeds 16 bits. No other products or versions are known to be impacted.

The flaw can be exploited remotely by any host that can transmit a crafted NAS Registration Request to the AMF. Because the service does not enforce authentication for the packet and the integer truncation bypasses input validation, an attacker can trigger the heap read with a single malicious packet. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of widespread exploitation is currently undocumented; however, a successful exploitation results in a process crash and loss of network service until the AMF is restarted.