CVE-2026-117069 in CN5G AMF
Summary
by MITRE • 11/02/2026
An integer truncation vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a malformed IMEISV in the 5GS Mobile Identity IE. The Type6NasIe::Validate() function truncates a 32-bit length value to 16 bits, bypassing length validation and causing an out-of-bounds heap read in DecodeImeisv(), which can crash the AMF process.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in OpenAirInterface CN5G Access and Mobility Management Function version 2.2.1 represents a critical security flaw within the Non-Access Stratum decoder, specifically affecting the handling of 5GS Mobile Identity Information Elements during registration procedures. This integer truncation issue arises from an improper conversion or casting operation where a 32-bit length value is erroneously truncated to a 16-bit unsigned integer before validation checks are performed. In network architecture, particularly within fifth-generation mobile networks, the AMF serves as a central control plane entity responsible for managing connection and mobility states of user equipment. The integrity of data structures passed between protocol layers is paramount, yet this implementation fails to preserve the full range of length values expected by subsequent decoding routines.
The technical mechanism of exploitation involves an unauthenticated remote attacker sending crafted NAS Registration Requests that contain a malformed IMEISV (International Mobile Equipment Identity Serial Number) field within the 5GS Mobile Identity Information Element. By specifying a length value greater than sixty-five thousand five hundred thirty-five, which exceeds the maximum capacity of a sixteen-bit unsigned integer, the truncation logic causes the validated length to wrap around or become significantly smaller than the actual data size present in the buffer. This discrepancy bypasses standard boundary checks that rely on this truncated value, leading directly to an out-of-bounds heap read operation within the DecodeImeisv function. The decoder attempts to process more bytes than allocated based on the false short length, resulting in memory corruption or a segmentation fault when accessing invalid memory addresses.
From an operational perspective, the immediate impact of this vulnerability is a denial of service against the AMF component. Since the flaw triggers a crash in the decoding routine during normal registration processing, repeated exploitation can cause the entire AMF process to terminate unexpectedly. In a production 5G core network environment, such instability disrupts critical signaling functions including authentication, authorization, and mobility management for connected user equipment. This disruption leads to service outages for subscribers attempting to register or re-register with the network, effectively rendering the affected node unavailable until it is manually restarted or patched. The lack of required authentication lowers the barrier to entry significantly, allowing any device within radio range capable of constructing malformed NAS messages to trigger this condition remotely without prior access credentials.
This vulnerability aligns closely with CWE-197, which classifies numeric truncation errors where a larger data type is converted to a smaller one resulting in loss of information or unexpected behavior. Furthermore, the exploitation technique maps to MITRE ATT&CK techniques related to Denial of Service via application layer attacks and potentially resource exhaustion through malformed input processing. The failure occurs at the boundary between protocol parsing and memory management, highlighting a common class of defects in telecommunications software where strict adherence to specification limits is not enforced during type casting operations.
Mitigation strategies must prioritize immediate patching to version 2.2.1 or later releases that address this specific integer truncation logic within the NAS decoder. Developers should implement explicit range checks on length fields before any conversion to smaller data types, ensuring that values exceeding the target type's maximum are rejected early in the parsing pipeline. Additionally, employing static analysis tools configured to detect potential numeric overflows and underflows during development can prevent similar defects from being introduced into other components of the core network function. Runtime protections such as heap sanitizers like AddressSanitizer should be utilized during testing phases to identify out-of-bounds memory accesses before deployment in production environments.