CN5G AMF 2.2.1 NAS Decoder DecodeSuci integer underflow

Summaryinfo

A vulnerability, which was classified as critical, has been found in CN5G AMF 2.2.1. The affected element is the function DecodeSuci of the component NAS Decoder. The manipulation leads to integer underflow. This vulnerability is documented as CVE-2026-117068. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in CN5G AMF 2.2.1. This issue affects the function DecodeSuci of the component NAS Decoder. The manipulation with an unknown input leads to a integer underflow vulnerability. Using CWE to declare the problem leads to CWE-191. The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An integer underflow vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a truncated SUCI in the 5GS Mobile Identity IE. Insufficient length validation in the DecodeSuci() function results in an out-of-bounds heap read, causing the AMF process to crash.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-117068 since 10/27/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/02/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• CN5G

Name

• AMF

Version

• 2.2.1

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion