UERANSIM gNB EUVD-2026-88204

Requires network/radio reachability to a running UERANSIM gNB (nr-gnb) at version <=3.3.0 that accepts UE connections. The attacker sends a plain (NOT_PROTECTED) Initial NAS message - the vulnerable path only decodes unprotected Registration Requests during AMF slice selection, so security-protected messages are passed through untouched and do not reach the throwing decoder. No authentication is required (PR:N) because Initial Registration precedes NAS security establishment, and no user interaction is needed. Limiting factors: exploitation only affects deployments of the UERANSIM simulator (predominantly test/lab/research environments rather than production networks), and impact is confined to crashing the gNB process (availability), with no confidentiality or integrity effect.

This is a low-to-moderate real-world risk: a denial-of-service, not a code-execution or data-exposure flaw. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VC:N/VI:N/VA:L/E:P, 6.9) and CWE-248 (uncaught exception) agree with the source-code evidence: DecodeNasMessage throws on a NAS message type or IEI it does not model, nothing in the NGAP task catches it, and because NtsTask runs onLoop on a bare thread the exception terminates the entire gNB process. So impact is availability-only - I actually lean toward A:H (the whole gNB dies) rather than the vendor's VA:L, which understates a full-process crash. There is NO confidentiality impact, which directly contradicts the 'Information Disclosure' tag (VC:N confirms this). Signals: POC exploit code is publicly available (VulDB gist) and a vendor patch exists, but there is NO EPSS score, NO CISA KEV listing, and no evidence of active exploitation - E:P (proof-of-concept) is the only exploit-maturity signal. Note a description/code discrepancy: the description names DecodePlainMmMessage in src/lib/nas/encode.cpp, while the published patch touches src/gnb/ngap/nas.cpp (extractSliceInfoAndModifyPdu, which calls DecodeNasMessage) - the crash surfaces in the NAS decode chain invoked from the gNB's NGAP handling; verify exact call path with vendor. Net: publicly-available PoC for a DoS in a niche 5G test tool - a patch-when-convenient issue, not an emergency.

A malicious or malformed UE sends an Initial (plain, unprotected) NAS Registration Request to the gNB containing a NAS message type or IEI that UERANSIM's decoder does not model. When the gNB decodes the PDU during AMF selection, DecodeNasMessage throws an exception that no handler catches, terminating the gNB process and dropping all attached UEs. Publicly available proof-of-concept exploit code exists (VulDB gist).