EUVD-2026-115351
GHSA-7xg6-2942-h668
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach SBI interface with valid SUPI
-
DeliveryCraft Nudm_UEAU request with oversized hex rand/auts
-
ExploitOverflow fixed-size stack buffer
-
ExecutionCorrupt stack canary, terminate UDM process
-
ImpactDeny 5G core authentication
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires (1) network reachability to the OAI CN5G UDM's SBI (Service-Based Interface), which in a correctly architected 5G core is an internal, segmented network between network functions rather than an internet-exposed surface, and (2) a valid SUPI to pass as the subscriber identifier. The attacker then targets the Nudm_UEAU Generate Authentication Data endpoint, supplying an oversized hex string in resynchronizationInfo.rand or auts. Limiting factors: the SBI is typically not publicly reachable, a valid subscriber identifier is needed, and impact is confined to denial of service - the described outcome is stack-canary abort and process termination, with no code execution demonstrated in the available sources. |
| Impact | This is a genuine but bounded-impact issue. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) scores availability-only: the description states the overflow corrupts the stack canary and terminates the UDM process, so the realistic outcome is denial of service, not code execution - no confidentiality or integrity impact is claimed. AV:N/AC:L/PR:N would normally read as trivially remote and unauthenticated, but the description adds two real preconditions: the attacker needs access to the SBI (Service-Based Interface, an internal 5G core network interface that is normally segmented and not internet-facing) and a valid SUPI (subscriber identifier). These are not CVSS 'privileges' but they materially narrow who can reach the endpoint, so the vector overstates exposure relative to the described deployment. EPSS is not provided and the vulnerability is not in CISA KEV, so there is no signal of active or widespread exploitation. The references include a GitHub issue and a public gist that appear to describe/demonstrate the flaw; this is a public PoC reference, not confirmed working weaponized exploit code. The vuln.today decision label is 'this_week', consistent with a patch-promptly (not emergency) posture. Net: treat as a prompt-to-fix DoS against 5G core infrastructure whose exposure depends heavily on whether the SBI is reachable by the attacker. |
| Exploit ScenarioDerived | An attacker who can reach the OAI CN5G UDM's SBI interface and possesses a valid SUPI sends a crafted Nudm_UEAU Generate Authentication Data request containing an oversized hex string in resynchronizationInfo.rand or auts. conv::hex_str_to_uint8() writes the decoded bytes into a fixed-size stack buffer without bounds checking, corrupting the stack canary and crashing the UDM, which denies subscriber authentication across the 5G core. A public PoC reference exists; it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
A stack-based buffer overflow in the OpenAirInterface CN5G UDM (v2.2.1) lets an unauthenticated network attacker who can reach the Service-Based Interface and supply a valid SUPI crash the UDM process by sending an oversized hex string in resynchronizationInfo.rand or auts to the Nudm_UEAU Generate Authentication Data endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:N, A:H) rates this 7.5, but real-world exposure is constrained: the SBI is normally an internal, segmented network between 5G core functions rather than an internet-facing surface, and the demonstrated outcome is stack-canary corruption leading to process termination, not code execution. No CISA KEV entry exists; a public gist reference is linked in the advisory data, but it is not verified as working exploit code, so treat this as a credible DoS bug with a potentially high blast radius for core-network availability rather than a confirmed actively exploited flaw.
RemediationAI
No vendor-released patch or fixed version is identified in the available data at time of analysis - the only vendor-linked reference is the tracking issue at https://github.com/openairinterface/oai-cn5g-udm/issues/4, so confirm remediation status there and with the OAI project before assuming a build is clean. Until a fix ships, address the three prerequisites the assessment calls out. First, remove reachability: enforce network policy so only the AUSF (and NRF, for discovery) can reach the UDM's Nudm_UEAU endpoint, and keep the SBI on the internal, segmented NF-to-NF network rather than routing it to untrusted networks - this is the highest-value control, and the trade-off is that misconfigured policy will break authentication flows between NFs. Second, enforce 3GPP service-based-interface authorization (mTLS and OAuth2 access tokens scoped to nudm-ueau) so that a caller without a legitimate NF identity cannot reach the parser at all, accepting the operational overhead of certificate and token lifecycle management. Third, front the UDM with an API gateway or reverse proxy that rejects Generate Authentication Data requests whose resynchronizationInfo.rand or auts exceed the expected hex lengths (rand is a fixed 128-bit value, auts a fixed 112-bit value) - this neutralizes the specific oversized-value trigger, at the cost of an extra hop and a rule set that must track the specification. To limit outage duration if a crash does occur, supervise the UDM process with automatic restart and alert on canary/abort terminations, while accepting that restart loops under sustained attack still degrade authentication availability. A public gist reference exists but is not verified as working exploit code, so do not treat it as a validated reproduction.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-121 (stack-based buffer overflow) in the OAI CN5G UDM's implementation of the Nudm_UEAU service, specifically the Generate Authentication Data operation used during 5G-AKA authentication. The resynchronizationInfo.rand and auts fields supplied in the request body are passed to the conv::hex_str_to_uint8() helper, which decodes a variable-length hexadecimal string into a fixed-size destination buffer without checking that the destination is large enough. Because the destination lives on the stack, an oversized value writes past the buffer into adjacent stack memory, including the stack canary; the resulting canary mismatch aborts the process. The advisory notes no bounds validation on the destination size as the root cause, and the described consequence is limited to availability (C:N/I:N, A:H) - no memory-corruption-to-code-execution path is demonstrated in the available sources. CPE metadata in the feeds is unpopulated (n/a), so the affected package is identified from the description and the linked GitHub issue rather than from NVD CPE matching.
Know when Openairinterface gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable SBI endpoint, low complexity, no privileges (a SUPI is a precondition not a CVSS privilege); only availability affected since the canary aborts the process, so C:N/I:N/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM Nudm_UEAU Generate Authentication Data endpoint. The UDM passes attacker-controlled resynchronizationInfo.rand and auts values to conv::hex_str_to_uint8(), which converts arbitrary-length hex strings into fixed-size stack buffers without validating the destination size. An unauthenticated attacker with access to the SBI interface and a valid SUPI can submit an oversized value to overwrite adjacent stack memory, corrupt the stack canary, and terminate the UDM process.
Executive ViewAI
A high-severity denial-of-service vulnerability in OpenAirInterface's 5G core UDM component (v2.2.1) could allow an unauthenticated attacker with network access to the internal Service-Based Interface to crash the UDM process. This threatens the availability of authentication services for all subscribers dependent on the affected 5G core, potentially disrupting connectivity and operations. While exploitation requires internal network access and no public exploit code is verified, leadership should prioritize mitigation to prevent service outages.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce strict network segmentation and access controls on the Service-Based Interface, deploy input validation at the API gateway to reject oversized or malformed parameters, and monitor logs for anomalous requests to the Nudm_UEAU endpoint.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
More in Openairinterface
View allA segmentation fault in openairinterface5g v2.1.0 allows attackers to cause a Denial of Service (DoS) via a crafted UE C
OpenAirInterface CN5G AMF<=v2.1.9 has a buffer overflow vulnerability in processing NAS messages. Unauthorized remote at
OpenAirInterface CN5G AMF<=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized remote att
Denial of service in OpenAirInterface CN5G AMF v2.2.1 allows a remote, unauthenticated attacker to crash the AMF process
Exploit-DB