The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
CVE-2026-106808: OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM Nudm_UEAU…
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-106808
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.5%
Summary
OpenAirInterface Core Network v2.2.1 contains a stack-based buffer overflow in the OAI CN5G UDM Nudm_UEAU Generate Authentication Data endpoint. The UDM passes attacker-controlled resynchronizationInfo.rand and auts values to conv::hex_str_to_uint8(), which writes arbitrary-length hex strings into fixed-size stack buffers without checking the destination size. An unauthenticated attacker with access to the SBI interface and a valid SUPI can overwrite adjacent stack memory, corrupt the stack canary, and terminate the UDM process.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.