Live › vulnerability › CVE-2026-106808
OpenAirInterface Core Network v2.2.1 has a stack buffer overflow in the UDM's Nudm_UEAU Generate Authentication Data endpoint, where attacker-supplied rand and auts hex strings are copied into fixed-size stack buffers without a size check. An attacker can overwrite stack memory, corrupt the stack canary, and terminate the UDM process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 18:24 UTC. All times on this page are UTC.
Operators running OpenAirInterface Core Network v2.2.1 with the UDM network function reachable on the SBI interface. The attacker must hold a valid SUPI, so deployments where the SBI is isolated to trusted network functions are less exposed. unknown whether a patched version exists.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| oai-cn5g-udm | vendor | 2.2.1 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM Nudm_UEAU Generate Authentication Data endpoint. The UDM passes attacker-controlled resynchronizationInfo.rand and auts values to conv::hex_str_to_uint8(), which converts arbitrary-length hex strings into fixed-size stack buffers without validating the destination size. An unauthenticated attacker with access to the SBI interface and a valid SUPI can submit an oversized value to overwrite adjacent stack memory, corrupt the stack canary, and terminate the UDM process.
This page as .md · .json · in your agent: get_signal("CVE-2026-106808")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.