---
id: "CVE-2026-117069"
kind: "vulnerability"
aliases: ["CVE-2026-117069"]
title: "OpenAirInterface 5G AMF: crafted registration request crashes core network process"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["5g-core", "amf", "cn5g", "infrastructure", "openairinterface"]
not_affected_if: ["other-amf-implementation"]
published_at: "2026-11-02T19:18:00+00:00"
first_seen_at: "2026-11-02T19:24:39+00:00"
updated_at: "2026-11-02T19:26:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117069", "first_seen_at": "2026-11-02T19:24:39+00:00"}]
---

# OpenAirInterface 5G AMF: crafted registration request crashes core network process

A length value in the NAS decoder of OpenAirInterface's CN5G AMF v2.2.1 is truncated from 32 to 16 bits, which skips a length check and causes an out-of-bounds heap read during IMEISV decoding. An unauthenticated remote attacker can send a crafted NAS Registration Request to crash the AMF process, causing denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the AMF in use is OpenAirInterface CN5G `v2.2.1` (for example via its version or build tag).
- Confirm the AMF is reachable from untrusted networks on the N1/NGAP path.

## Timeline

- 2026-11-02T19:24:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117069

## From the sources

An integer truncation vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a malformed IMEISV in the 5GS Mobile Identity IE. The Type6NasIe::Validate() function truncates a 32-bit length value to 16 bits, bypassing length validation and causing an out-of-bounds heap read in DecodeImeisv(), which can crash the AMF process.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_