UERANSIM
CVE-2026-7183
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable UDP listener, no auth or interaction required, crash limited to simulator availability with no confidentiality or integrity impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability has been found in aligungr UERANSIM up to 3.2.7. The affected element is the function rls::DecodeRlsMessage in the library src/lib/rls/rls_pdu.cpp of the component Radio Link Simulation Layer. The manipulation of the argument pduLength leads to uncaught exception. The attack may be initiated remotely. Upgrading to version 3.2.8 is sufficient to fix this issue. The identifier of the patch is ca1a66fffe282767bb08618af9f848e3b68ea47b. It is suggested to upgrade the affected component. This behavior is related to CVE-2024-37877. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
AnalysisAI
Uncaught exception in UERANSIM up to v3.2.7 allows remote unauthenticated attackers to crash the Radio Link Simulation (RLS) message decoder by sending a crafted PDU with an oversized or malformed pduLength field, causing denial of service against 5G simulation sessions. The SSVC framework marks this as automatable with a POC exploit available, though real-world impact is constrained to research and testing environments given the product's deployment profile. A vendor patch (v3.2.8) was released promptly after responsible disclosure, confirmed by the upstream GitHub release tag.
Technical ContextAI
UERANSIM (cpe:2.3:a:aligungr:ueransim:*:*:*:*:*:*:*:*) is an open-source 5G UE/RAN simulator used for testing 5G Core Networks. The vulnerable component is the Radio Link Simulation (RLS) layer, specifically the DecodeRlsMessage function in src/lib/rls/rls_pdu.cpp. The root cause (CWE-248: Uncaught Exception) is the absence of bounds validation before calling readOctetString(pduLength): a crafted pduLength value exceeding the remaining buffer size triggers an out-of-range read, which propagates as an unhandled exception and crashes the decoder. Compounding the issue, pduLength was originally read as a signed int32 via read4I(), meaning a negative value could be implicitly coerced to a large unsigned size. The fix adds explicit remainingSize() checks at each read point, switches pduLength to uint32_t read via read4UI(), validates message and PDU type enums before dereferencing, and enforces caps on UE count (MAX_UE_COUNT=1024) and pending ACK entries.
RemediationAI
Upgrade UERANSIM to v3.2.8, confirmed via the vendor release tag at https://github.com/aligungr/UERANSIM/releases/tag/v3.2.8 and patch commit ca1a66fffe282767bb08618af9f848e3b68ea47b at https://github.com/aligungr/UERANSIM/commit/ca1a66fffe282767bb08618af9f848e3b68ea47b. This is a source-distributed C++ project, so users must rebuild from the v3.2.8 tag. If immediate upgrade is not feasible, restrict network access to the RLS UDP port (typically 4997/UDP) to trusted simulation hosts only, using host firewall rules or network ACLs - this prevents unauthenticated remote attackers from reaching the vulnerable decoder, at the cost of limiting legitimate remote UE simulation. There is no configuration knob to disable RLS without disabling core simulator functionality.
Same weakness CWE-248 – Uncaught Exception
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today