The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
InfoVulnerability
CVE-2026-117069: An integer truncation vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an…
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-117069
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.2%
Summary
CVE-2026-117069 affects the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1. An unauthenticated remote attacker can send crafted NAS Registration Requests with a malformed IMEISV in the 5GS Mobile Identity IE. The Type6NasIe::Validate() function truncates a 32-bit length to 16 bits, which bypasses length validation and causes an out-of-bounds heap read in DecodeImeisv(), crashing the AMF process.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.