Live › vulnerability › CVE-2026-117069
A length value in the NAS decoder of OpenAirInterface's CN5G AMF v2.2.1 is truncated from 32 to 16 bits, which skips a length check and causes an out-of-bounds heap read during IMEISV decoding. An unauthenticated remote attacker can send a crafted NAS Registration Request to crash the AMF process, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 19:24 UTC. All times on this page are UTC.
Teams running the OpenAirInterface CN5G AMF, typically in private 5G core or lab deployments, where the AMF accepts NAS messages from radio access networks. Deployments running other AMF implementations or versions not stated as affected are not covered by the sources. unknown whether any specific mitigation exists.
No product ranges from the sources yet.
v2.2.1 (for example via its version or build tag).No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An integer truncation vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a malformed IMEISV in the 5GS Mobile Identity IE. The Type6NasIe::Validate() function truncates a 32-bit length value to 16 bits, bypassing length validation and causing an out-of-bounds heap read in DecodeImeisv(), which can crash the AMF process.
This page as .md · .json · in your agent: get_signal("CVE-2026-117069")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.