FlexRIC v2.0.0 contains a reachable assertion in e2ap_recv_sctp_msg() that checks the size of incoming SCTP payloads against a fixed 32KB buffer. Sending a payload larger than this limit triggers the assert and results in a SIGABRT, crashing the near‑RT RIC, iApp, E2 Agent, or xApp process. In Release builds the stripped assert leads to a signed‑to‑unsigned integer overflow, potentially causing an out‑of‑bounds read. No valid E2AP protocol data unit is required, so the fault can be invoked by any malformed SCTP packet.

The vulnerability resides in FlexRIC version 2.0.0 and affects all four SCTP endpoint types that listen on ports 36421 and 36422. These endpoints expose services for the near‑RT RIC, iApp, E2 Agent, and xApp components.

The flaw can be exploited remotely by an unauthenticated attacker who can send a single oversized SCTP packet. Because the attack does not require authentication or a valid protocol message, the attack vector is readily usable over the public network. The CVSS score is 7.5, the EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating that while active exploitation has not been confirmed, the path is available to adversaries aware of the exposed SCTP ports.