CVE-2026-117069

The record

An integer truncation vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a malformed IMEISV in the 5GS Mobile Identity IE. The Type6NasIe::Validate() function truncates a 32-bit length value to 16 bits, bypassing length validation and causing an out-of-bounds heap read in DecodeImeisv(), which can crash the AMF process.

Affected packages

Related vulnerabilities

• CVE-2026-116742 HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in… CWE-197
• CVE-2026-116012 Ghidra before 12.2 contains a numeric truncation vulnerability in… CWE-197
• CVE-2026-115889 Wasmtime is a runtime for WebAssembly. CWE-197
• CVE-2026-70177 Numeric truncation error in Microsoft Windows Search Component allows an authorized… CWE-197
• CVE-2026-70123 Numeric truncation error in Microsoft Graphics Component allows an authorized attacker to… CWE-197
• CVE-2026-96280 The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and… CWE-197
• CVE-2026-19667 If an attacker-controlled authoritative server can produce a negative answer that is… CWE-197
• CVE-2026-87529 Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a… CWE-197