CVE-2026-106808 in OpenAirInterface
Summary
by MITRE • 11/02/2026
OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM Nudm_UEAU Generate Authentication Data endpoint. The UDM passes attacker-controlled resynchronizationInfo.rand and auts values to conv::hex_str_to_uint8(), which converts arbitrary-length hex strings into fixed-size stack buffers without validating the destination size. An unauthenticated attacker with access to the SBI interface and a valid SUPI can submit an oversized value to overwrite adjacent stack memory, corrupt the stack canary, and terminate the UDM process.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in OpenAirInterface Core Network version 2.2.1 represents a critical security flaw within the User Data Management (UDM) component of the 5G core architecture. Specifically, this issue resides in the Nudm_UEAU Generate Authentication Data endpoint, which is part of the Service-Based Interface responsible for handling authentication data generation for user equipment. The root cause of this vulnerability is a stack-based buffer overflow resulting from improper input validation and memory management practices within the conv::hex_str_to_uint8 function. This function is designed to convert hexadecimal string representations into fixed-size unsigned integer arrays stored on the call stack, yet it fails to verify that the length of the incoming hex string matches or remains below the capacity of the destination buffer. Consequently, when an attacker supplies a resynchronizationInfo.rand or auts value containing more characters than can be safely accommodated by the allocated memory space, the function writes data beyond the bounds of the intended array, leading to direct corruption of adjacent stack memory regions.
From a technical perspective, this flaw allows for arbitrary write operations on the process stack, which poses severe risks to system integrity and availability. The immediate operational impact involves the potential overwriting of critical control flow data, including return addresses and exception handlers stored alongside local variables. Most notably, modern compilers often employ stack canaries as a defense mechanism against buffer overflow attacks by placing a sentinel value between local buffers and control information on the stack. In this scenario, an unauthenticated attacker possessing access to the Service-Based Interface and a valid Subscription Permanent Identifier (SUPI) can craft maliciously sized inputs that overwrite these stack canaries. The detection of such corruption typically triggers immediate termination of the affected UDM process by the operating system or runtime environment to prevent further exploitation. This results in a denial-of-service condition, disrupting authentication services for all users relying on this specific network function and potentially causing cascading failures across dependent core network components that expect continuous availability from the UDM.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-121, which describes stack-based buffer overflow conditions arising from insufficient bounds checking during memory copy operations. Furthermore, in the context of the MITRE ATT&CK framework for enterprise security, this exploitation technique corresponds to Tactic TA0004 (Privilege Escalation) and specifically Technique T1059 (Command Execution), although in its current observed state, it primarily facilitates availability impact through process termination rather than full remote code execution. The lack of authentication requirements at the point of entry for certain parameters exacerbates the risk, as any entity with network access to the SBI can attempt this attack vector without needing valid credentials beyond a basic SUPI structure.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary fix involves modifying the conv::hex_str_to_uint8 function to enforce strict length validation before performing any memory copy operations, ensuring that the input size never exceeds the predefined buffer capacity. Additionally, implementing bounds-checking libraries or using safer string handling functions can prevent similar issues in other parts of the codebase. From an operational standpoint, deploying network-level access control lists to restrict SBI traffic only from authorized network function instances is essential until patches are applied. Organizations should also enable comprehensive logging and monitoring for abnormal termination events within the UDM process to detect potential exploitation attempts early. Regular security audits focusing on memory safety in C++ codebases, particularly those involving cryptographic or authentication logic, will help identify similar vulnerabilities before they can be exploited by adversaries seeking to disrupt 5G core network operations.