CVE Feed

    Dashboard / CVE / CVE-2026-117069

    CVE-2026-117069

    An integer truncation vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a malformed IMEISV in the 5GS Mobile Identity IE. The Type6NasIe::Validate() function truncates a 32-bit length value to 16 bits, bypassing length validation and causing an out-of-bounds heap read in DecodeImeisv(), which can crash the AMF process.

    Published:Nov 2, 2026
    Last Modified:Nov 3, 2026
    EPS:Nov 2, 2026
    EPSS Score:0.00233
    CVSS Score:7.5

    Affected Products

    Vendor
    Openairinterface
    Product
    Oai-cn5g-amf

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-540 Overread Buffers

    Related CVEs

    CVE-2026-117067 — An out-of-bounds memory access vulnerability in the N2 SCTP interface of OpenAirInterface (OAI) CN5G AMF v2.2.…
    CVE-2026-117068 — An integer underflow vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unau…
    CVE-2026-30080 (CVSS 7.5) — OpenAirInterface v2.2.0 accepts Security Mode Complete without any integrity protection. Configuration has sup…
    CVE-2026-30075 (CVSS 7.5) — OpenAirInterface Version 2.2.0 has a Buffer Overflow vulnerability in processing UplinkNASTransport containing…
    CVE-2026-30079 (CVSS 9.8) — In OpenAirInterface V2.2.0 AMF, Out of sequence messages causes incorrect state transition during UE registrat…
    CVE-2026-30078 (CVSS 7.5) — OpenAirInterface V2.2.0 AMF crashes when it receives an NGAP message with invalid procedure code or invalid PD…
    CVE-2025-66786 (CVSS 7.5) — OpenAirInterface CN5G AMF<=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized …
    CVE-2025-65805 (CVSS 7.5) — OpenAirInterface CN5G AMF<=v2.1.9 has a buffer overflow vulnerability in processing NAS messages. Unauthorized…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High