Integer Underflow in OpenAirInterface CN5G AMF NAS Decoder

Executive Summary

CVE-2026-117068 is an integer underflow vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1. It allows an unauthenticated remote attacker to cause a denial of service (DoS) by sending crafted NAS Registration Requests with a truncated SUCI in the 5GS Mobile Identity IE. Insufficient length validation in the DecodeSuci() function leads to an out-of-bounds heap read, crashing the AMF process.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in the OAI CN5G AMF or AUSF processes, especially during NAS Registration Requests or Authentication Response handling. Check logs for heap corruption errors or stack smashing detection messages. Inspect network traffic for malformed SUCI or RES* fields in NAS messages.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service (DoS) by crashing the AMF process, disrupting network services for all users. An attacker can exploit it remotely without authentication, leading to service outages and potential loss of connectivity for legitimate users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial-of-service (DoS) conditions in 5G core network components (AMF and AUSF) by crashing processes through crafted NAS messages. While it does not directly expose personal data, prolonged DoS conditions could disrupt critical services handling sensitive information, potentially violating availability requirements in GDPR and HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update OAI CN5G AMF and AUSF to the patched versions. Apply input validation for SUCI and RES* fields in NAS messages. Block malformed NAS traffic at the network edge. Restart affected services after applying fixes to clear any residual corruption.

Useful 0 Not Useful 0