CVE-2026-8781
Null Pointer Dereference in OMEC Project AMF
Publication date: 2026-05-18
Last updated on: 2026-05-18
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| omec-project | amf | 2.1.3-dev |
| omec-project | amf | From 2.2.0 (inc) |
| omec-project | amf | 2.0.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-404 | The product does not release or incorrectly releases a resource before it is made available for re-use. |
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-8781 is a security flaw in the omec-project AMF component up to version 2.1.3-dev, specifically in the RANConfiguration function of the ngap/handler.go file. The vulnerability causes a null pointer dereference when processing malformed NGAP messages, such as RANConfigurationUpdate, which can lead to a crash of the AMF service.
This flaw can be exploited remotely by sending specially crafted NGAP messages that trigger the null pointer dereference, causing the application to panic and terminate unexpectedly.
The issue has been fixed in version 2.2.0 by adding validation checks, nil/empty checks, and safer parsing mechanisms to prevent crashes from malformed inputs.
How can this vulnerability impact me? :
Exploitation of this vulnerability can cause the AMF component of the 5G core network to crash, resulting in denial of service (DoS). This disrupts critical 5G network functions such as registration management, connection management, and mobility management.
A denial of service in the AMF can impact network availability and reliability, potentially affecting users' ability to connect or maintain sessions on the 5G network.
Since the AMF handles important signaling and security context management, its unavailability could degrade overall network performance and security posture.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for crashes or panics in the AMF component, specifically related to the handling of malformed NGAP messages such as RANConfigurationUpdate. Observing segmentation faults (SIGSEGV) or application termination in the AMF logs may indicate exploitation attempts.
Since the vulnerability involves malformed NGAP messages causing null pointer dereference, network traffic inspection for unusual or malformed NGAP RANConfigurationUpdate messages could help detect attempts.
Suggested commands include checking the AMF process logs for panic or crash messages, for example using:
- journalctl -u amf.service --since "1 hour ago" | grep panic
- grep -i 'segmentation fault' /var/log/syslog
- tcpdump -i <interface> -w ngap_capture.pcap 'udp port 38412' # NGAP typically uses SCTP port 38412, adjust if needed
Analyzing captured NGAP traffic for malformed RANConfigurationUpdate messages can be done with protocol analyzers like Wireshark.
What immediate steps should I take to mitigate this vulnerability?
The primary and recommended mitigation is to upgrade the omec-project AMF component to version 2.2.0 or later, where this vulnerability has been fixed.
Until the upgrade can be applied, consider implementing network-level protections such as filtering or blocking malformed NGAP messages, especially RANConfigurationUpdate messages, to reduce the risk of exploitation.
Monitoring the AMF logs for crashes or panics can help detect exploitation attempts early.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in the omec-project AMF component could impact the availability of the 5G core network by causing crashes through malformed NGAP messages, potentially leading to denial-of-service conditions.
While the AMF is designed to be compliant with 5G network function standards and supports secure communication mechanisms such as HTTPS with certificate validation, the specific vulnerability described does not directly mention effects on confidentiality or integrity of personal data.
Therefore, there is no explicit information indicating that this vulnerability directly affects compliance with common data protection regulations like GDPR or HIPAA.