The flaw lies in the PRB utilization metric calculation within OpenAirInterface5G 2.4.0. The code divides by the difference of two consecutive total_prb_aggregate samples without verifying that the divisor is non-zero. When two samples are identical, the operation triggers a floating‑point exception, crashing the entire nr-softmodem process and bringing down the base station. This results in an abrupt and comprehensive loss of service for all user equipments attached to the cell. No authentication is required before an attacker can trigger the vulnerability, making it straightforward to exploit. The weakness is essentially a division-by-zero error.

This issue affects the OpenAirInterface5G 2.4.0 openair2/E2AP/RAN_FUNCTION/O-RAN/ran_func_kpm_subs.c implementation of the E2SM-KPM RAN Function. The software component lives in the base station’s nr-softmodem process, which is responsible for running the 5G radio access network. No other products or vendor versions are specified in the advisory.

Executing the exploit requires no authentication and can be performed by an adversary who can send a high volume of E42_RIC_SUBSCRIPTION_REQUEST messages to the FlexRIC iApp via port 36422/SCTP. The CVSS score is 8.6 and the EPSS score is < 1%, signifying a high‑severity vulnerability with a very low but non-zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting that no confirmed public exploitation has been reported yet, although the potential for widespread denial of service remains high.