EUVD-2026-88056
GHSA-mqvr-mhj9-rgx9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect to gNB as UE peer
-
DeliveryCraft malformed dedicatedNASMessage in RRC
-
ExploitSend ULInformationTransfer to nr-gnb
-
ExecutionTrigger memory corruption in handler.cpp
-
ImpactCrash gNB simulator (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to a running UERANSIM nr-gnb instance (version up to 3.3.0) and the ability to send RRC signaling to it as a UE peer, then supplying a manipulated dedicatedNASMessage in an ULInformationTransfer message. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required, and the attack is remote (AV:N) with low complexity (AC:L). Limiting factors: the target is an open-source 5G simulator typically confined to research/test networks rather than internet-exposed production, and the attacker must be able to reach the gNB's signaling interface; demonstrated impact is availability loss (crash) only, not confidentiality or integrity. |
| Impact | This is a real but bounded issue best characterized as a remote crash/DoS rather than a critical RCE. The vendor (VulDB) CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L) scores impact as availability-only (VA:L) with no confidentiality or integrity effect, which is notably conservative for a CWE-119 memory-corruption bug - memory corruption CAN sometimes escalate beyond a crash, but neither the description nor the vendor claims code execution, so the demonstrated impact is a low-severity availability loss. Exploitation status: publicly available exploit code exists (POC gist), reflected in the E:P (Proof-of-Concept) exploit-maturity flag; this is NOT the same as active exploitation - there is no CISA KEV listing and no EPSS score in the input, so exploitation is possible-but-unproven-in-the-wild. The attack path (a malicious/rogue UE sending a crafted RRC ULInformationTransfer to the gNB) is network-reachable and low-complexity, but the affected product is a research/test simulator, not production carrier infrastructure, which sharply limits real-world blast radius. Net: modest priority - patch or upgrade in lab/CI environments running UERANSIM, but this is not an internet-scale emergency. |
| Exploit ScenarioDerived | An attacker positioned as (or spoofing) a connected UE on the radio/network interface of a UERANSIM nr-gnb instance sends a crafted RRC message containing a malformed dedicatedNASMessage argument, which is mishandled in ULInformationTransfer (src/gnb/rrc/handler.cpp) and triggers memory corruption. The result is corruption/crash of the gNB simulator process, disrupting the 5G test environment. A public proof-of-concept exploit is available on GitHub (gist), lowering the effort to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Remote denial of service in aligungr UERANSIM up to 3.3.0 allows an unauthenticated network attacker who can reach the nr-gnb signaling interface to trigger memory corruption by sending a crafted dedicatedNASMessage in an RRC ULInformationTransfer message. The assessed impact is limited to availability loss (crash) rather than code execution, confidentiality, or integrity compromise, and the affected software is an open-source 5G simulator typically deployed in research or test networks. Publicly available exploit code exists, and the vendor was reportedly contacted but did not respond.
RemediationAI
No vendor-released patch identified at time of analysis; the vendor was contacted and did not respond, so no fixed UERANSIM version can be confirmed from the available data. Until an official patch is released, restrict access to the nr-gnb RRC/NAS signaling interface to trusted UEs on an isolated lab VLAN or firewall it from untrusted networks, and consider disabling nr-gnb when the gNB simulator is not actively needed. For maintainers who can modify UERANSIM, add strict length validation and bounds checking for the dedicatedNASMessage argument in src/gnb/rrc/handler.cpp before any copy or memory operation; trade-offs are reduced simulation testing flexibility and the need to track a custom fork. Monitor gNB logs for crashes or malformed ULInformationTransfer messages, and review the VulDB advisory at https://vuldb.com/vuln/410842 and exploit reference at https://gist.github.com/centauruszzz/c69a6bd152f45d9ca8db981f7da34bed for updates. If a patched release later appears, upgrade to that exact version after confirming it fixes this CVE.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
UERANSIM is an open-source 5G SA simulator implementing UE and gNB (nr-gnb) functions, including RRC signaling and NAS transport. The flaw resides in src/gnb/rrc/handler.cpp in ULInformationTransfer, where the dedicatedNASMessage argument is processed without sufficient validation, leading to CWE-119 memory corruption/buffer overflow. The CPE cpe:2.3:a:aligungr:ueransim:*:*:*:*:*:*:*:* identifies aligungr UERANSIM, with the description bounding affected releases to 3.3.0 and earlier. Exploitation requires sending RRC messages as a UE peer; per the assessed CVSS vector PR:N/UI:N, no authentication or user interaction is needed, and the demonstrated consequence is a remote crash/DoS.
Know when Ueransim gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Remote unauthenticated crafted RRC message with no interaction (AV:N/AC:L/PR:N/UI:N); impact limited to a simulator crash (A:L), no confidentiality or integrity effect per vendor VA:L-only assessment.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in aligungr UERANSIM up to 3.3.0. This affects the function ULInformationTransfer of the file src/gnb/rrc/handler.cpp of the component nr-gnb. Performing a manipulation of the argument dedicatedNASMessage results in memory corruption. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
An uncaught exception in the NAS message decoder of aligungr UERANSIM's gNB component (nr-gnb, versions up to and includ
Uncaught exception in UERANSIM up to v3.2.7 allows remote unauthenticated attackers to crash the Radio Link Simulation (
Exploit-DB