OpenAirInterface CN5G AMF CVE-2026-117069

No authentication is required: the flaw is reached while parsing a NAS Registration Request, which the AMF processes before UE authentication, matching PR:N/UI:N. The specific trigger is a malformed IMEISV encoded in the 5GS Mobile Identity IE whose 32-bit length is truncated to 16 bits by Type6NasIe::Validate(), defeating length validation and causing an OOB heap read in DecodeImeisv(). The practical limiting factor is delivery: an attacker must be able to send NAS signaling to the AMF's N1/NAS interface (normally via a gNB or the N2 reference point on the 5G signaling plane), rather than over the open internet. Exploitation is confirmed only against CN5G AMF v2.2.1.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects an availability-only impact: a remote, unauthenticated attacker can crash the AMF with low complexity and no user interaction, but there is no confidentiality or integrity impact (C:N/I:N). The attack surface is credible because NAS Registration Requests are processed before UE authentication, so PR:N is justified. Signals are mixed: there is no CISA KEV listing and no EPSS value in the input, so widespread automated exploitation is not evidenced; a public PoC reference exists (a gist) but it is not verified as working exploit code, so availability of a reliable exploit is uncertain. The vuln.today Decision label is 'this_week', indicating prioritized but not emergency handling. The real-world weight is driven less by raw CVSS than by the role of the component: the AMF is a central, often non-redundant control-plane function in a 5G core, so a crash can deny registration service network-wide. However, the affected product (OpenAirInterface CN5G AMF) has a limited production footprint, which lowers aggregate risk compared to a ubiquitous target. No input signal conflicts with the vector; the main gaps are the absence of EPSS/KEV data and no vendor-confirmed fixed version in the provided evidence.

An attacker with access to the 5G signaling plane sends a crafted NAS Registration Request containing a malformed IMEISV in the 5GS Mobile Identity IE to a CN5G AMF v2.2.1. The oversized 32-bit length is truncated to 16 bits in Type6NasIe::Validate(), bypassing length validation and causing an out-of-bounds heap read in DecodeImeisv() that crashes the AMF process and denies registration service. A public PoC reference exists (gist); it is not verified as working exploit code.