CVE-2026-117068 in AMF
Summary
by MITRE • 11/02/2026
An integer underflow vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a truncated SUCI in the 5GS Mobile Identity IE. Insufficient length validation in the DecodeSuci() function results in an out-of-bounds heap read, causing the AMF process to crash.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in OpenAirInterface CN5G Access and Mobility Management Function version 2.2.1 represents a critical security flaw within the Non-Access Stratum decoder component of the 5G core network infrastructure. This specific issue stems from an integer underflow condition that occurs during the processing of NAS Registration Requests sent by user equipment to the AMF. The root cause lies in insufficient length validation logic implemented within the DecodeSuci function, which is responsible for parsing the Subscription Concealed Identifier contained in the 5GS Mobile Identity Information Element. When a remote attacker crafts a malicious registration request featuring a truncated SUCI payload, the decoder fails to correctly validate the boundaries of the input data before performing arithmetic operations on length fields. This lack of rigorous boundary checking allows an integer underflow to occur, which subsequently leads to an out-of-bounds heap read operation rather than triggering a proper error handling routine or rejecting the malformed packet.
From a technical perspective, this vulnerability exploits the memory management mechanisms of the underlying system by causing the application to access memory locations outside its allocated buffer space. The consequence of this out-of-bounds read is immediate instability within the AMF process, typically resulting in an application crash and subsequent denial of service for all connected subscribers relying on that specific network function instance. Because the vulnerability can be triggered via crafted NAS messages sent over standard 5G signaling interfaces without requiring any prior authentication or security context establishment, it poses a severe threat to the availability of critical core network services. An unauthenticated attacker positioned at the radio interface or able to inject packets into the control plane can exploit this flaw repeatedly to disrupt service continuity and degrade the overall reliability of the telecommunications infrastructure.
This incident aligns with Common Weakness Enumeration category CWE-190, which classifies integer overflow or wraparound vulnerabilities that lead to other security issues such as buffer overflows or out-of-bounds accesses. Furthermore, in the context of the MITRE ATT&CK framework for enterprise cybersecurity, this vulnerability facilitates techniques associated with Initial Access and Impact categories, specifically allowing an adversary to perform Denial of Service attacks against network infrastructure components. The ability to crash a core function like the AMF without authentication highlights significant gaps in input validation protocols within open-source 5G implementations, underscoring the necessity for robust defensive coding practices when handling variable-length protocol fields.
To mitigate this risk and prevent similar vulnerabilities in future deployments, it is imperative that developers implement strict length checks before any arithmetic operations are performed on data field sizes. The DecodeSuci function must be updated to verify that the reported length of the SUCI does not exceed the actual available buffer size and that subtraction or calculation logic cannot result in negative values or underflows. Additionally, integrating fuzzing tools into the continuous integration pipeline can help identify such boundary condition errors early in the development lifecycle. Network operators should also consider deploying intrusion detection systems capable of identifying anomalous NAS message patterns indicative of exploitation attempts for this specific vulnerability until a patched version is available and deployed across all affected network elements.