CVE-2026-106808
Received Received - Intake

Stack-Based Buffer Overflow in OpenAirInterface Core Network

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: MITRE

Description
OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM Nudm_UEAU Generate Authentication Data endpoint. The UDM passes attacker-controlled resynchronizationInfo.rand and auts values to conv::hex_str_to_uint8(), which converts arbitrary-length hex strings into fixed-size stack buffers without validating the destination size. An unauthenticated attacker with access to the SBI interface and a valid SUPI can submit an oversized value to overwrite adjacent stack memory, corrupt the stack canary, and terminate the UDM process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-106808

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow in the UDM Nudm_UEAU Generate Authentication Data endpoint. The vulnerability occurs when the UDM processes attacker-controlled hex strings (resynchronizationInfo.rand and auts) without validating their size. This allows an unauthenticated attacker with a valid SUPI to submit oversized values, causing stack memory corruption and potentially crashing the UDM process.

Detection Guidance

To detect this vulnerability, monitor the UDM process for crashes or segmentation faults after receiving authentication requests. Check logs for SIGSEGV errors or UDM process terminations. Use network traffic analysis tools like tcpdump or Wireshark to inspect HTTP/2 POST requests to the Nudm_UEAU endpoint for oversized rand or auts fields in resynchronizationInfo.

Impact Analysis

This vulnerability could allow an attacker to crash the UDM service, leading to denial of service for authentication functions. If exploited successfully, it may disrupt core network operations and compromise the availability of subscriber authentication services.

Compliance Impact

This vulnerability primarily impacts availability and integrity of 5G network services, which could indirectly affect compliance with standards like GDPR or HIPAA by disrupting critical authentication processes. A denial-of-service condition in the UDM could prevent proper subscriber authentication, potentially leading to unauthorized access or service disruptions that violate data protection requirements. However, the direct impact on compliance depends on how the affected system is implemented in a regulated environment.

Mitigation Strategies

Update OpenAirInterface Core Network to a patched version that validates input sizes for resynchronizationInfo.rand and auts values before processing. Restrict access to the SBI interface to trusted sources only and ensure SUPI validation is enforced.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106808. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...